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Abstract — Conventional face-to-face classrooms are still the main 
learning system applied in Indonesia. In assisting such 
conventional learning towards an optimal learning, formative 
evaluations are needed to monitor the progress of the class. This 
task can be very hard when the size of the class is large. Hence, 
this research attempted to create a classroom monitoring system 
based on student's data of Department of Electrical Engineering 
and Information Technology UGM. In order to achieve the goal, 
a student modeling using Case-Based Reasoning (CBR) was 
proposed. A generic student model based on jCOLIBRI 2.3 
framework was developed. The model represented student's 
knowledge of a subject. The result showed that the system was 
able to store and retrieve student's data for suggestion of the 
current situation and formative evaluation for one of the subject 
in the Department. 

Keywords- case-based reasoning; student modeling; jCOLIBRI 



I. 



Introduction 



Every classroom learning process has its own challenges. 
These challenges are often different depending on many 
factors. One possible cause is the composition of the attendants 
which has different backgrounds. Furthermore, having too 
many students in the class often make the teaching, learning, 
and evaluation process very hard. Yet, classroom monitoring is 
indeed very important to be done to ensure that students will 
successfully pass a course, hence, a monitoring system is 
required. 

A model of effective instruction was written by Slavin 
(1995). The model is called QAIT model that consists of 
Quality, Appropriateness, Incentive, and Time [1]. Quality 
refers to the quality of instruction. Incentive refers to the degree 
to which the teacher makes sure that the students are well- 
motivated to work on the task. Time refers to the degree to 
which students are given the right amount of time to learn the 
material [1]. However the model's component that became the 
emphasis of this paper is Appropriateness which refers to the 
appropriateness level of instruction, which is the degree to 
which the teacher makes sure that the instruction is appropriate 
to the student's level of understanding. QAIT model suggests 
that a personal approach is needed to achieve an optimal 
learning result. 



On the other hand, formative evaluation [2] is the 
evaluation process of an educational program while it is still in 
development, with the purpose of continually improving the 
program. Thus, implementing formative evaluation will 
optimize the learning result. However, the implementation will 
not be easy when the size of the class is large, i.e. consists of 
more than 70 students. To help the implementation of 
formative evaluation in a big classroom, Information 
technology can be used as a tool. 

The determination of delivering education material that 
follows Slavin's Appropriateness criteria and ability to execute 
formative evaluation faces challenges when the size of the class 
is large. This paper proposed a framework on this problem by 
developing a student model using case-based reasoning 
technique. Based on individual student model, a classroom 
monitoring system can be performed and personalized 
recommendations were given to students as well as teachers to 
refine the learning process. 

The rest of the paper is organized in the following way. The 
concept of student modeling is described in section II. Section 
III presents case-based reasoning method in general and 
jCOLIBRI as a framework based on CBR. Section IV describes 
the proposed framework. Result of the experiments and the 
analysis is presented in section V. Finally, Section VI 
concludes with a summary and a future plan. 



II. 



Student modeling 



Student Modeling (SM) is defined as the process of 
acquiring knowledge about the student in order to provide 
services, adaptive content and personalized instructional flow/s 
according to specific student's requirements [3]. Even though, 
student modeling techniques have been applied in many 
eLearning systems, the techniques are rarely used in 
conventional classrooms. Most SMs are built to support 
classroom learning that utilizes web-based learning or 
Intelligent Tutoring System (ITS). However fewer SMs are 
built to support face-to-face classroom learning. 

Various techniques have been used to represent student 
models such as rules, fuzzy logic, Bayesian networks (BN), 
and case-based reasoning (CBR). Bayesian network is among 
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the most used techniques, thus, there are many resourceful 
researches. Previous work by Gonzalez, Burguillo and Llamas 
describes a qualitative comparison between SM using BN and 
CBR[4]. Generally BN is described as a complex technique 
that needs high computation and has a complex process in 
extracting knowledge, meanwhile CBR is said to have more 
advantages as it is easier to handle, renew and maintained. 
CBR based SM is proved to provide more evidence and reason 
when a student misconception happened. It also facilitates 
supervision of student by enabling the tutor to have a 
continuous view of student performance, including quantitative 
and qualitative information. 

The result of this previous research became the foundation 
of choosing Case-Based Reasoning as a method to build a 
student model in this research. 
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III. 



Case-Based reasoning 



Case-Based Reasoning is a method to solve problem using 
solutions taken to solve previous problems [5]. This step is 
executed with the belief that the same problem will have the 
same solution. Rather than depending on the general 
knowledge of the problem or the relationship of the problem 
and the solution, CBR focuses more on using specific 
knowledge about the problem, situation and case that has been 
experienced. 

CBR is a branch of artificial intelligence, where it is 
specifically related with automating reasoning using previous 
cases, problem definition for the current situation, and search 
of the previous problem and adapting the previous solution for 
a new problem. CBR is considered new to the field of problem- 
solving and machine learning. 

CBR consists of four stages or known as 4R stage: 
Retrieve, Reuse, Revise and Retain. The cycle of the four 
stages is illustrated in Figure 1 . 



ProWem ± 




Revise 



Confirmed -nliilmn 



Proposed solution 



Figure 1. CBR Cycle [5] 



The first stage is Retrieve. In this stage there is a process of 
extracting cases from one or a group of cases that is nearest to 
the new case. In computing the nearest case, the NN algorithm 
is used. The formula for NN is shown in (1). 



similar ity(T,S~) ■ 



where T is the new case, S is the case in the case base, n is the 
number of attribute in every case, i is the individual case 
between 1 to «,/is the similarity function between case T and 
case S, and w is the weight assigned for j-th attribute that has 
value between 0<w<l . 

The second stage is Reuse where the solution of the 
previous case is reused to suggest solution to the new case. The 
third stage is Revise. In this stage, before storing the solution of 
the new case, the attributes' value of the case can be revised. 
Finally the last stage is Retain, where all of the information of 
the new case is stored in the case base. 

jCOLIBRI 

jCOLIBRI is an object oriented framework that is built to 
facilitate the design and implementation of a CBR system [6]. 
jCOLIBRI used Java programming language as a basis and 
JavaBeans for case representation. This framework is 
developed by an artificial intelligence group, GAIA, of 
University of Compultense, Madrid. 

jCOLIBRI's main architecture consists of elements as 
follows: 

1. Organization into three layers, persistence, core and 
presentation layers. Persistence is managed by 
connectors that access the persistence media and load 
the cases into different in-memory organizations. Core 
contains basic classes that has been previously 
defined. 

2. Organization of the applications into precycle, cycle 
and postcyle. Moreover, new stages can be defined to 
be executed at different execution points. This add-on 
enables the development of maintenance or evaluation 
procedures. 

3. Case structure consists of description, result, solution 
and justification. 



IV. A Proposed Framework 

The outcome of this research is a student model that is to be 
mapped into a system of case-based reasoning using jCOLIBRI 
as a tool. This system becomes the entity representation to 
evaluate case based reasoning of how effective it is to be a 
system for student modeling. 

In this research a real classroom is selected where 
information such as student's data and course structure are 
learned. This information become the main materials to create 
a student model. 

A. Student Model 

After gathering information from a class, to represent the 
student's knowledge, a student model is created. This model is 
divided into components such as Student ID, cumulative GPA 
when the course is taken, grade of prerequisite courses, skills 
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and/or experiences, competence that should be reached, exam 
or quiz result, and final grade. With Retrieval method using 
NN, the most similar previous case is obtained. Figure 2 shows 
the main tasks performed in the case-based reasoning technique 
to create the student model. 
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final grade of the course. These components became attributes 
of the cases that are organized into description, solution, result 
and justification. 



ObtainQiieryWithFonnMethod 



After conducting this research, it is found that to get 
student's information from an "offline" class is harder than 
"online" class. The elements that are found in the offline class 
are only those that have numeric value in it, such as quiz or 
exam result in contrast to online class that can measure history 
or student's activity. In offline classes it is difficult to examine 
other things such as learning style. 




CombineQiier^AndCasesMetliod End 



DefinelDsMethod 



\ 



Figure 2. The tasks in CBR method in creating SM 



Figure 3 illustrates the generic student model, where all of 
the components are stored in a case base of CBR system. 




Figure 3. Student Model Representation 



Student model that is specifically built for the 
Microprocessor System course has the component such as ID, 
GPA, grade of prerequisite course such as Digital Systems and 
Basic Programming, experiences and skill using assembly 
language and programming language, and designing an 
instrument. There are also quiz results, mid exam result and 



B. 4R Stages 

The 4R Stages of this system starts with the Retrieval stage 
where query of the new case is entered to find the similar 
cases. Figure 3a illustrates the query entry on the system. 
Users can enter value at the attribute field. From this query, 
NN scoring is used to find the most similar cases. These cases 
are shown in the Figure 3b. 

Users can browse through these five most similar cases 
before choosing one from the five cases. By browsing through 
the cases, user can get some insight from the similar cases by 
observing their pattern. From the five cases users can choose 
one case where the attribute of the chosen case is reused, 
therefore the Reuse stage is conducted. 

The third stage is the Revision stage. Here the components 
of the case are reviewed and the attributes are enabled to 
editing as shown in Figure 4a. If the new case has some 
differences to the selected case or some of the values needs to 
be updated, adjustments can be made in this stage. 

Revision is also used to add more data into the case base if 
there is no case in the case base that is exactly the same with 
the new case. To add a new case into the case base a new ID 
needs to be defined. 

The last stage is Retain. Retain is the activity where the 
new case is stored into the case base for future use as shown in 
Figure 4b. When the ID of the case is defined, either the same 
or new ID, the next button here is where the Retain stage is 
executed. 



Quenj - Student Modeling 
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Figure 4. Query Panel and Result Panel 
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Figure 5. Revision Panel 

C. System Impact 

To examine the impact of the system as a tool to support 
formative evaluation, the following test is conducted. 

There is a set of information about a student but only up to 
his mid-exam score ('UTS'). This student has a background 
with a good grade in his prerequisite courses but has low score 
on quiz and mid-exam. 

After entering this data into the query, previous cases are 
obtained. There are four previous cases with the final grade of 
B and one previous case with A. It can be implied that there is 
a chance for this student to get good final grade. The case that 
has final grade of A shows significant change to the next quiz 
result and final exam. It means the student must do well in the 
next quiz and final exam. However if there is no significant 
change, like the other four results, most likely this student will 
getB. 

V. Advantages and Disadvantages 

There are many advantages of CBR that is found in this 
research. Firstly is its simple computation. CBR's main 
computation is in its Retrieval stage on searching for the 
similar case. The rest activities in CBR only include storing 
and presenting data. Secondly, CBR do not look at any 
relation between the attributes. Some other SM techniques has 
relation between attributes and adds complexity to the system. 
Then CBR enables revision, which made the case base of the 
system stays updated. 

However, some disadvantages are also found through this 
research. Firstly, the accuracy of the data depends on the case 
base. It means that all the data entered must be valid and the 
case base must stay updated. Secondly, one system can only 
be used for one course. The student model is general, but the 
system is specific to only one course. Other courses might 
have different attributes due to different teaching or different 
prerequisites. 

jCOLIBRI as a framework also has many advantages and 
disadvantages that is found at the process of this research. The 
advantages of jCOLIBRI is that it uses Java, a language that is 
already common and have many IDE for programming. 
jCOLIBRI also have many previously written methods. 
However this can be the one of the drawbacks where system 
development depends on the availability of the method in the 
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framework. For example, the data of the whole class cannot be 
observed because jCOLIBRI does not support to do so. 

jCOLIBRI lacks in documentation. As a newly developed 
framework this is understandable. But there is no user forum, 
so there is no keeping track of those who use this framework 
for different purposes. This is seen as a major drawback in the 
programming field. 

VI. Conclusion 

In this research project, a student model has been made 
based on CBR by using jCOLIBRI framework. Several 
conclusions can be drawn as the following. 

• jCOLIBRI can facilitate 4R of CBR well. 

• In implementing a student model, both CBR and 
jCOLIBRI has its own advantages and 
drawbacks. 

• The system can support formative evaluation in 
the course Microprocessor Systems by showing 
patterns of previous cases to the student as their 
feedback. However the system can only show the 
cases individually, not as a whole class data. 

• This system can help student and lecturer in 
predicting their final grade, thus an improvement 
effort can be made accordingly. 

Overall, some recommendations in implementing a 
system for student model in the future are listed below. 



1. Teachers/lecturer must define clearly the structure of 
the lesson in advance. It must be clearly stated when 
they are going to take score (how many quiz and 
exams). The class must also have a complete 
documentation. 

2. Complete data of student is needed prior to 
conducting the class. 

3. The existing e-learning system can also be integrated 
here. 

4. As jCOLIBRI has several drawbacks, the system can 
also be supported with other features outside the 
framework that are compatible. 

References 



[1] Slavin, R. E. (1995). A Model of Effective Instruction. Educational 
Forum, 59(2), 166-176. 

[2] Romero, C, & Ventura, S. (2007). Educational data mining: A survey 
from 1995 to 2005. Elsevier Expert Systems with Applications 33, 135- 
146. 

[3] Paneva, D. (2006). Use of Ontology-Based Student Model in Semantic- 
Oriented Access to the Knowledge in Digital Libraries. HUBUSKA 
Fourth Open Workshop "Semantic Web and Knowledge Technologies 
Applications". Varna, Bulgary. 

[4] Gonzlalez, C, Burguillo, I., Llamas, M. (2005). A comparison of case- 
based reasoning and bayesian networks for student modeling in 
intelligent learning environments. 16* European Conference on Machine 
Learning (ECML) and the 9th European Conference on Principles and 
Practices of Knowledge Discovery in Databases (PKDD). Espera de 
publicatoon. 



http://sites.google.com/site/ijcsis/ 
ISSN 1947-5500 



(IJCSIS) International Journal of Computer Science and Information Security, 

Vol. 10, No. 10, 2012 
[5] Atanassov, A., & Antonov, L. (2012). Comparative Analysis of Case [7] M. Young, The Technical Writer's Handbook. Mill Valley, CA: 

Based Reasoning Software Frameworks jCOLIBRI and myCBR. Journal University Science, 1989. 

of the University of Chemical Technology and Metallurgy, 83-90. 

[6] Garcia, J. A. (2008). jCOLIBRI : A multi-level platform for building and 
generating CBR systems. Madrid: Universidad Complutense de 

Madrid. 



http://sites.google.com/site/ijcsis/ 
ISSN 1947-5500 



(IJCSIS) International Journal of Computer Science and Information Security, 
Vol. 10, No. 10, October 2012 



ESTIMATION OF EFFORT IN SOFTWARE 

COST ANALYSIS FOR HETEROGENOUS 

DATASET USING FUZZY ANALOGY 



S.Malathi 
Research Scholar, Dept of CSE, 

Sathyabama University, 
Chennai, Tamilnadu, India 
malathi_raghu@hotmail.com 



Dr.S.Sridhar 

Research Supervisor,Dept of CSE & IT, 

Sathyabama University, 

Chennai, Tamilnadu, India 

drssridhar@yahoo.com 



Abstract — One of the significant objectives of software 
engineering community is to use effective and useful models for 
precise calculation of effort in software cost estimation. The 
existing techniques cannot handle the dataset having categorical 
variables efficiently including the commonly used analogy 
method. Also, the project attributes of cost estimation are 
measured in terms of linguistic values whose imprecision leads to 
confusion and ambiguity while explaining the process. There are 
no definite set of models which can efficiently handle the dataset 
having categorical variables and endure the major hindrances 
such as imprecision and uncertainty without taking the classical 
intervals and numeric value approaches. In this paper, a new 
approach based on fuzzy logic, linguistic quantifiers and analogy 
based reasoning is proposed to enhance the performance of the 
effort estimation in software projects dealing with numerical and 
categorical data. The performance of this proposed method 
illustrates that there is a realistic validation of the results while 
using historical heterogeneous dataset. The results were analyzed 
using the Mean Magnitude Relative Error (MMRE) and 
indicates that the proposed method can produce more explicable 
results than the methods which are in vogue 

Keywords- cost estimation; analogy; fuzzy logic; linguistic values; 
effort estimation; heterogeneous dataset. 



I. 



Introduction 



Software cost estimation has gained tremendous 
importance in the last two decades due to its imperative 
necessity for efficient effort estimation in software analysis. In 
general, effort estimation for software projects is categorized 
as algorithmic and non algorithmic models [1]. Algorithmic 
estimation deals with the application of mathematical 
computation method while Non algorithmic estimation is 
essentially based on machine learning techniques. Software 
cost estimation by analogy is one of the most conspicuous 
machine learning techniques and is basically a form of Case- 
Based Reasoning [2], Estimation by analogy is based on the 
assumption that similar software projects have similar costs. 
However, the technique needs improvement especially while 
handling the categorical variables. 



Fuzzy logic cost estimation models [3] are more suitable for 
projects with indistinct and imprecise information. The 
advantage of this method is that it interprets the linguistic 
values very much similar to the human way of interpretation. 
However, this method is not able to overcome the imprecision 
and uncertainty problem in an efficient manner. The proposed 
method resourcefully estimates the software effort using 
Fuzzy analogy technique based on reasoning by analogy and 
fuzzy logic. 

The paper is divided into 5 sections as follows. Section 2 
discusses the related work. The key features of the Fuzzy 
Analogy approach are presented in section 3. In section 4, an 
explorative analysis is conducted for validating the proposed 
method and based on the results; a refined Fuzzy Analogy 
approach with the performance outcome is illustrated in 
section 5. The conclusion of the findings is dealt in Section 6. 

II. RELATED WORK 

Effort estimation during the initial stages of project 
development is invariably essential for the software industry to 
cope with the unrelenting and competitive demands of today's 
world. The estimation should also be accurate, reliable and 
precise to meet the growing demands of the industry. Keung [ 
4] demonstrates that the estimation by analogy is a viable 
alternative to predict accuracy and flexibility where the 
prediction of effort is done by selecting a set of completed 
projects which are akin to the new projects. Hasan Al-Sakran 
[5] has highlighted that retrieval of similar projects from the 
dataset can be effectively done by an improved CBR 
integrated with different methods. Recently, a new method has 
been proposed [6] to improve Analogy based software 
estimation by conducting empirical experiments with tools 
such as ESTOR and ANGEL. 

A new framework has been elucidated [7], based on 
fuzzy logic, for estimation of effort during the initial stage 
itself, especially for projects representing linguistic variables. 
A transparent and improved Fuzzy logic based framework [8] 
is proposed for effectively dealing with the imprecision and 
uncertainty problem. The Gaussian MFs [9] have been used in 
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the fuzzy framework, which show good results while handling 
the imprecision in inputs. The ability of this method to adapt 
itself to the varying environment in as much as its efficient 
handling of the inherent imprecision and uncertainty problem 
makes it a valid choice for representing fuzzy sets. 

A multi agent system has been employed [10] to deal 
with the characteristics of the team members in a fuzzy 
system. Many studies have been carried out [11] which utilize 
the fuzzy systems to deal with the ambiguous and linguistic 
inputs of software cost estimation. In [12], it is noted that 
homogeneous dataset results in better and more accurate effort 
estimates while the irrelevant and disordered dataset results in 
lesser accuracy in effort estimation. Wei Lin Du et al. [13] 
proposed a methodology combining the neuro-fuzzy technique 
and SEER-SEM that can function with various algorithmic 
models. 



III. PROPOSED WORK 



A. 



Analogy 

The basic idea of prediction of effort in cost estimation by 
analogy [14] is that projects having similar features such as 
size and complexity will be similar with respect to project 
effort. The method gains its importance since the estimate is 
based on actual project experience. 

B. Fuzzy Logic 

Fuzzy logic is based on the human behaviour and 
reasoning. It is similar to fuzzy set theory and used in cases 
where decision making is difficult. A Fuzzy set can be defined 
by assigning a value for an individual in the universe of 
discourse between the two boundaries that is represented by a 
membership function. 



categorical values. These values will be represented by fuzzy 
sets. In the case of numerical value X , its fuzzification will 
be done by the membership function which takes the value of 
1 when X is equal to X and otherwise 

For categorical values, it is supposed to have M 

attributes and for each attribute M . , a measure with linguistic 

J 

value is defined ( A/ ). Each linguistic value, A/ , is 

represented by a fuzzy set with a membership function 

( jU ■ ). It is preferable that these fuzzy sets satisfy the 

A ( 
normal condition. The use of fuzzy sets to represent 
categorical data, such as 'very low' and 'low', is similar to the 
way in which humans interpret these values and consequently 
it allows to deal with the vagueness, imprecision and 
uncertainty in the case identification step. 

2) Retrieval of Cases: This step is based on the selection of 
software project similarity measure. In retrieval of cases, a set 
of candidate measures is proposed for selecting software 
project similarity. These measures assess the overall similarity 

of two projects P andP , d\P,,Pr.j by combining all the 
individual similarities of P and P associated with the 
various linguistic variables V . describing the project P 
andP , d LP, ,P, ). After an axiomatic validation of some 

proposed candidate measures for the individual 
distances d [P. ,P~ j, two measures have been retained [15]. 



A= j// A (x)/x 
x 



(1) 



Where x is an element in X and u A (x) is a membership 

function. A Fuzzy set is represented by a membership function 
that has grades between the interval [0, 1] called grade 
membership function. 



d v .( P l> P 2 ) = 



max 
k 



min(u j (Fj),(i j (P 2 )) 
A k A k 



max-min aggregation 

ZH , (P^XLt (P 2 ) 



A- 



A- 



k rt k rt k 

sum-product aggregation 



(2) 



C. Fuzzy Analogy 



Fuzzy analogy is the fuzzification of classical analogy 
procedure. It comprises of three steps. 1) Identification of 
cases 2) Retrieval of similar cases and 3) Case adaptation. 
Each step is the fuzzification of its equivalent classical 
analogy procedure. 

1) Identification of cases: The main objective of Fuzzy 
analogy method is to effectively deal with the categorical data. 
In identification of cases, each project is indicated by a set of 
selected attributes which can be measured by numerical or 



Where A/ is the fuzzy set associated with V ■ and 
jU • which are the membership functions representing fuzzy 

A J 



sets Ajf 
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Effort=A*(SIZE) 



B+0. 



-N 



oi*Y^\d. 
^i=l i *TT EMi 



(3) 



Where A and B are constants, d is the distance and EM 
effort multipliers. By using the above formula the effort is 
estimated. 

3) Case Adaptation: The objective of this step is to derive an 
estimate for the new project by using the known effort values 
of similar projects. In the proposed method, all the projects in 
the data set are used to develop an estimate of the new project. 
Each historical project will contribute to the calculation of the 
effort of the new project according to its degree of similarity 
with this project. 
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IV. Results and discussion 

The historical heterogeneous dataset used in this study is 
the Deshamais, Nasa 60 and Nasa 93 dataset published in 
PRedictOR Models in Software Engineering (PROMISE) 
[18]. The proposed work is implemented by using the default 
packages of JAVA Net beans. Table 1, summarizes the 
number of projects collected under each dataset with the actual 
average effort compared with the estimated average effort 
using fuzzy analogy method. 



TABLE 1. COMPARISON OF ACTUAL AVG. EFFORT WITH 
ESTIMATED AVG.EFFORT. 



Figure. 2. Comparative Results of actual and estimated effort with the Nasa 60 

dataset 



Dataset 


No. of 
Projec 
ts 


No. of 

features 


Actual 
Avg.Effort 


Estimated 
Avg.Effort 


Nasa60 


60 


2 


406.413 


359.324 


Nasa93 


93 


2 


734.031 


530.148 


Desharnais 


77 


2 


5046.308 


4786.311 
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Figure. 3. Comparative Results of actual and estimated effort with the Nasa 93 

dataset 
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Figure. 1 . Comparison of Actual Avg Effort and Estimated Avg.Effort 
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Figure. 4. Comparative Results of actual and estimated effort with the 
Desharnais dataset 

From Fig. 2-4, it is inferred that the proposed method is very 
efficient with less effort value compared to the actual effort 
present in the existing three dataset. 



Fig. 1 indicates the comparative performance of actual average 
and estimated average effort for the 3 dataset. 
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V. PERFORMANCE ANALYSIS 

A common criterion for the evaluation of effort 
estimation models is the Mean Magnitude of relative Error 
(MMRE). The MRE and MMRE can be measured by 
employing the following formulae 



MRE 



\acti - est\l acti 



MMRE(%) = -J^MRE * 100 



(4) 



(5) 



Where the act; is the actual effort, est; is the estimated effort 
and N is the no of cases. The comparison of proposed method 
with the existing method based on MMRE measure is 
tabulated in Table 2. 

TABLE 2. COMPARISON OF MMRE IN PERCENTAGE WITH THE 
EXISTING METHODS. 



Dataset 


Nasa60 


Nasa93 


Desharnais 


Proposed 
Method 


5.15 


6.95 


4.98 


Analogy with 
Fuzzy Number 


33.37 


28.55 


26.89 


Fuzzy method 


32.651 


54.81 


30.6 



The MMRE measure for Nasa 60,Nasa 93 and Desharnais 
dataset of the proposed method is compared to the existing 
method [3][16] [17]. 



■ Proposed method 

■ Fuzzy method 



' Analogy with Fuzzy 



1 




. 


1 





Figure. 5. Comparison Performance of MMRE (%) 

Fig. 5 clearly depicts that the MMRE value for the 
heterogeneous dataset is very low compared to the different 
existing methods, thereby proving that the proposed method is 
very efficient. 

VI. CONCLUSIONS 

The existing techniques for estimation of effort in software 
cost analysis are not able to handle the categorical variables in 
as much as they could not overcome the imprecision and 
uncertainty problem in an efficient manner. Fuzzy analogy 



has been developed subsequently to address these issues. 
However, the results are not very effective while handling the 
categorical data and necessitate improvement. Fuzzy analogy 
based on reasoning by analogy, fuzzy logic and linguistic 
quantifiers has been utilized for enhancing the performance as 
well as to overcome the imprecision and uncertainty. In the 
proposed method, both categorical and numerical data are 
represented by fuzzy sets. The salient benefit of this method is 
that it can overcome the imprecision and uncertainty problem 
to a considerable extent while describing the software project. 
The results also clearly indicate that proposed method 
effectively estimates the effort for the historical heterogeneous 
project datasets. 

However, the existing methods and present research work 
deals only with the project characteristics for effort estimation 
but the important attributes such as team characteristics have 
been neglected. Therefore, the future research warrants a 
pragmatic approach to include the team member 
characteristics to evaluate the project effort in a resourceful 
manner. 
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Abstract — This paper presents a new intelligent algorithm that 
can solve the problems of finding the optimum solution in the 
state space among which the desired solution resides. The 
algorithm mimics the principles of bat sonar in finding its targets. 
The algorithm introduces three search approaches. The first 
search approach considers a single sonar unit (SSU) with a fixed 
beam length and a single starting point. In this approach, 
although the results converge toward the optimum fitness, it is 
not guaranteed to find the global optimum solution especially for 
complex problems; it is satisfied with finding "acceptably good" 
solutions to these problems. The second approach considers 
multisonar units (MSU) working in parallel in the same state 
space. Each unit has its own starting point and tries to find the 
optimum solution. In this approach the probability that the 
algorithm converges toward the optimum solution is significantly 
increased. It is found that this approach is suitable for complex 
functions and for problems of wide state space. In the third 
approach, a single sonar unit with a moment (SSM) is used in 
order to handle the problem of convergence toward a local 
optimum rather than a global optimum. The momentum term is 
added to the length of the transmitted beams. This will give the 
chance to find the best fitness in a wider range within the state 
space. The algorithm is also tested for the case in which there is 
more than one target value within the interval range such as 
trigonometric or periodic functions. The algorithm shows high 
performance in solving such problems. In this paper a 
comparison between the proposed algorithm and genetic 
algorithm (GA) has been made. It showed that both of the 
algorithms can catch approximately the optimum solutions for all 
of the testbed functions except for the function that has a local 
minimum, in which the proposed algorithm's result is much 
better than that of the GA algorithm. On the other hand, the 
comparison showed that the required execution time to obtain the 
optimum solution using the proposed algorithm is much less than 
that of the GA algorithm. 

Keywords- Bat sonar; Genetic Algorithm; Particle swarm 
optimization 



I. 



Introduction 



The basic concept of any optimizing problem is to identify 
the alternative means of a given objective and then to select the 
alternative that accomplishes the objective in the most efficient 
manner, subject to constraints on the means. The problem can 
be represented mathematically as, 



Optimize y = f(xj, x 2 , ..., x n ) 



Subject tog;(X,;t 2 ,...,xJ 



< 



> 



(1) 
bj j=l,2,...,m (2) 



Equation (1) is the objective function and (2) constitutes the 
set of constraints imposed on the solution. The x t (i = 1,2,..., n) 
represent the set of decision variables, and y-f(xi, x 2 , ..., x„) is 
the objective function expressed in terms of these decision 
variables. Depending on the nature of the problem, the term 
optimize means either maximize or minimize the value of real 
function by systematically choosing input values from within 
an allowed set and computing the value of the function. 

In general, optimization can be defined as the process of 
finding a best optimal solution for the problem under 
consideration. 

Today, optimization comprises a wide variety of techniques. 
These techniques can be found in several literatures. 
Evolutionary computing may be the most prominent one in 
this field. In the 1950s and the 1960s several computer 
scientists independently studied evolutionary systems with the 
idea that evolution could be used as an optimization tool for 
engineering problems. The idea in all these systems was to 
evolve a population of candidate solutions to a given problem, 
using operators inspired by natural genetic variation and 
natural selection [1]. In 1975, Holland described how to apply 
the principles of natural evolution to optimization problems 
and built the first genetic algorithms (GA) [2], In the last 
several years there have been widespread interaction among 
researchers studying various evolutionary computation 
methods, and the boundaries between GAs, evolution 
strategies, evolutionary programming, and other evolutionary 
approaches have broken down to some extent. These 
techniques are being increasingly widely applied to a variety 
of problems, ranging from practical applications in industry 
and commerce to leading-edge scientific research [3]. 

Particle swarm optimization (PSO) is another technique 
that optimizes a problem by iteratively trying to improve a 
candidate solution with regard to a given measure of quality. 
PSO is a form of swarm intelligence and is inspired by bird 
flocks, fish schooling and swarm of insects [2]. It is used as a 
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heuristic search method for the exploration of solution spaces 
of complex optimization problems. Development on the PSO 
technique over the last decade has been made by different 
researchers. The heuristic in PSO suffers from relatively long 
execution times as the update step needs to be repeated many 
thousands of iterations to converge the swarm on the global 
optimum. Soudan, B. and Saad, M. [4] explored two dynamic 
population size improvements for classical PSO with the aim 
of reducing execution time. The most attractive features of 
PSO are its algorithmic simplicity and fast convergence. 
However, PSO tends to suffer from premature convergence 
when applied to strongly multimodal optimization problems. 
Lu H., et al. [5] proposed a method of incorporating a real- 
valued mutation (RVM) operator into the PSO algorithms, 
aimed at enhancing global search capability. The PSO 
contains many control parameters. These parameters cause the 
performance of the searching ability to be significantly 
alternated. In order to analyze the dynamics of such PSO 
system rigorously, Tsujimoto, T. et al. [6] proposed a 
canonical deterministic PSO system which does not contain 
any stochastic factors, and its coordinate of the phase space is 
normalized. The found global best information influences the 
dynamics. They regarded this situation as the full-connection 
state. The authors try to clarify the effective parameters on the 
CD-PSO performance. Feng Chen, et al. [7] proposed an 
improved PSO by incorporating the sigmoid function into the 
velocity update equation of PSO to tackle some drawbacks of 
PSO in order to obtain better global optimization result and 
faster convergence speed. 

PSO shares many common points with GA. Both 
algorithms start with a group of a randomly generated 
population; both have fitness values to evaluate the 
population, both update the population and search for the 
optimum with random techniques. However, unlike GA, PSO 
has no evolution operators such as crossover and mutation. On 
the other hand, it is important to mention in this introduction 
that GAs and PSO do not guarantee success [2], and some 
times are not guaranteed to find the global optimum solution 
to a problem. They are satisfied with finding acceptably 
solutions to the problem. 

This paper introduces a new intelligent algorithm. The 
proposed algorithm is a problem solving technique that uses 
the principles of bat sonar as its model in searching the 
approximate optimum solution for the problems. The 
algorithm introduces three search approaches, a single search 
unit, multisearch units, and a single search unit with a 
momentum. Each of these approaches can approximately find 
the optimum solution in solving the required problem with a 
reasonable efficiency depending on the complexity of the 
problem and the number of optimum points that exist in the 
problem. 

This paper is organized as follows; the next section 
describes the main proposed algorithm. Section 3 introduces 
more efficient search approaches. Section 4 contains the 
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of this work. 



II. 



Main Algorithm 



The sonar of a bat is an active echolocation system. In 
addition to providing information about how far away a target 
is, bat sonar conveys information about the relative velocity of 
the target, the size of various features of the target, and the 
azimuth and elevation of the target [8]. 

In order to find its prey the bat may sit on a perch or fly 
around using its sonar signals. Some type of bats are 
considered as a 'high duty cycle' bat since it produces signals 
80% of the time that it spends echolocating [9]. When a bat 
begins to echolocate it usually produces short millisecond long 
pulses of sonar, and listens to the returning echoes. If prey is 
detected by the bat, it will generally fly toward the source of 
the echo. The bat appears to be an amazing signal processing 
machine that has an accuracy of 99%. The way in which the 
bat can measure the distance and the size of its prey is as 
shown in Fig. 1 [10]. 



M ———--= 



~^I 



SUBTENDED ANCLE 




SUBTENDED 
ANCLE PLUS 
DiTANrF — C I7F 



Fig. 1 . Sonar signal of a bat 

The proposed algorithm search for optimum solutions in 
problems depends mainly on these principles. In this 
algorithm, each and every point in the search space represents 
one possible solution. The sonar in this algorithm transmits 
several signals in different directions starting from a proposed 
starting point. Each transmitted signal contains a batch of N 
beams. These beams are of fixed length. The returned values 
(value of the fitness function at the end point of each beam) 
are checked with each other and compared with the starting 
point to determine the optimum one. If optimum point is 
detected, the sonar unit flies toward this point exchanging its 
starting point with the new one, then starts to transmit signals 
again from this point in different directions searching for 
better optimum solution. Otherwise, the sonar unit stays in its 
original starting point and retransmits signals in other 
directions. This process is repeated until the algorithm finds 
the best optimum solution. 

Fig. 2 illustrates a sample on how the proposed algorithm 
searches for the optimum point. In this figure the sonar unit 
transmits beams of signals starting from point PI. The 
returned signals find better solution in P2. This causes the 
sonar to fly toward P2. This process is continued with P3, then 
with P4. 

In this example, it is assumed that the entire returned 
signals to P4 are not fitter than P4, thus the algorithm 
considers P4 to be the optimum point. 
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x, =x ms + Lcos(9+(i-l)9) (3) 



Fig. 2. Search process for optimum solution 

The fitness function considered in the proposed algorithm, 
is the evaluation function that is used to determine the 
solution. This function can be n-dimensional. The optimal 
solution is the one with the best fitness function. 

The main proposed algorithm in this paper considers a 
single sonar unit (SSU) flying in the state space searching for 
the optimum solution. This scenario represents the first search 
approach introduced in this work. The details of the algorithm 
are as follows: 
Step 1. Initialize the following main parameters: 

Solution range: min, max values of the search space 

variables. 

Beam length L: random value not exceeding half the 

solution range: 

L< Rand ^Solution _range/2 
Number of beams N: Small integer random value 
representing the number of beams in each single 
transmitted signal. 

Starting point pos s : any point in the search space 
selected randomly. 

Angle between beams : one of two techniques are 
assumed to be used in this algorithm. The first one is to 
randomly select a small fixed value between any two 
successive beams, while the other technique is to 
randomly select a different angle , between any two 
successive beams, where (i=l, ... , N-l). We called 
these two techniques "Fixed " and "Rand " respectively. 
The above mentioned parameters are showed in Fig. 3. 
Step 2. Evaluate the fitness function at the start point F s . 
Step 3. While stopping condition is false, do Steps 4-7. 
Step 4. Select random value representing the main beam 

direction m starting from pos s . 
Step 5. Transmit N beams starting from pos s with main 
beam direction of „, and angle between any two 
successive beams. 
Step 6. Determine the coordinates of the remote end point 
post for each transmitted beam (i=l,...,N), then 
evaluate the fitness function F : at these ends. As an 
example, in a three dimension state space: 



Lsin(9 m + (i-l)9) 



(4) 



y i y pos s 
pos t = [x i ,y i ] 
F t = fix, y) 
Step 7. Compare the fitness values; 

If F s is the optimum value (i.e., for maximizing F s > 

F h and for minimizing F s < F,) then go to step 3 
Otherwise: 
Replace the coordinates of pos s with the 
coordinates of the optimum point of F, and 
replace F s with the optimum F{. 
pos s = posj of optimum F t 
F s = optimum F h 
then go to step 3 
Step 8. Test for stopping condition: The algorithm can be 
terminated according to following stopping criteria: 
A fixed number of iterations have occurred. 
All solutions converge to the same value and no 
improvements in the fitness value are found. 




Fig. 3. Single batch of beams contained in a single transmitted signal 

The algorithm is a kind of a parallel search; this comes 
from the fact that the technique used here is to check for 
several solutions at once. Over iterations, selection for best 
fitness leaves out bad solutions and gets the best in each step. 
Thus, the proposed algorithm tries to converge to optimal 
solutions. 

In SSU, although the results converge toward the minimum 
or maximum fitness, it is not guaranteed to obtain the global 
optimum solution, especially in complex problems with wide 
state space. This leads to develop more efficient search 
approaches. 

III. More Efficient Search 

This paper introduces two other more efficient search 
approaches, in which, the first one uses multisonar search 
units, while the other one adds a momentum term to the beams 
length. The backbone of these two algorithms is the main 
algorithm of SSU approach mentioned previously. 



13 



http://sites.google.com/site/ijcsis/ 
ISSN 1947-5500 



A. Multisonar Search Units (MSU) 

This approach considers multisonar units (m) search for the 
optimum solution/s at the same moment. Each sonar unit has 
its own starting point. These units are working in parallel in 
the same search space. For an example Fig. 4 shows an MSU 
with three sonar units. This approach can be used in solving 
more complex, large search space problems, and in problems 
that have several optimum values. Because of the parallelism 
nature of this approach, MSU can reduce the execution time 
needed to find the optimum solution considerably especially in 
problems with large state space. 




(IJCSIS) International Journal of Computer Science and Information Security, 

Vol. 10, No. 10, October 2012 
considered to be the same. This will give the chance to make a 
worthy and meaningful comparison between the performances 
and the efficiencies of the three approaches. These parameters 
are: 

Number of beams in each transmitted signal N=5 

Angle between any two successive beams for 

Fixed technique = jt/12 

Maximum number of iterations in each run =100 

Number of runs (epochs) = 500 

The performance of each approach is considered to be the 
degree on how much the obtained solution meets the goal. 
Where the goal is assumed here as the value that is equal or 
approximately equal to the optimum solution. Thus, for each 
solved function, the overall performance p for the used 
approach is determined as, 

p=S g /Mxl00% (6) 

Where, S g is the number of the obtained solutions greater than 
or equal to the goal, and M is the total number of epochs. In 
this work two goal values are considered. The first one is 
assumed to be greater than 97.5% of the optimum solution, 
while the second one is greater than 96% of the optimum 
solution. The corresponding calculated performances for these 
goals are named p t and p 2 respectively. 
And the overall efficiency r| is calculated as 



Fig. 4. MSU with three sonar units 

B. Single Sonar Units with A Momentum (SSM) 

Sometimes the solution found by SSU is not guaranteed to 
be the global optimum. This mainly comes from the nature of 
the problem and its state space, or due to the random selection 
of the initial parameters especially for the beam length. In 
such cases, the selected length of the transmitted beam, 
whatever the direction is, is either very long or very short so 
that it can not exceed to the area in which the solution is a 
global minima or maximum. SSM introduces a momentum 
term \x in order to reduce the problem of convergence toward a 
local optimum. In this approach, when the sonar unit 
converges toward an optimum solution, this solution will be 
checked again to be assured that it is not a local optimum. The 
proposed technique used here is to add a momentum term to 
the length of the transmitted beams. Using a momentum gives 
the chance to search for optimum solution in a wider range 
within the search space. The value of the momentum is 
considered to be within the range 0<(J.<1. The new beam 
length then becomes: 



L old a+\i) 



(5) 



IV. 



Experimental results 



Different types of fitness functions are used to test and 
evaluate the proposed algorithm with its three search 
approaches. In these tests, some of the initial parameters are 



r\ = AverageObtainedFitness /OptimumFitness xl00% 



x!00% 



(7) 



The average Euclidean distance \\E d \\ between the obtained 
solutions and the optimum one are calculated as follows: 

1 ' M 




F obt y 



(8) 



Where, 

F opt is the fitness of the optimum solution, 

F obt is the fitness of the obtained solution using the 
proposed algorithm. 

The used fitness functions and their tests results are as 
follows: 

A. The first used function is a third order polynomial with a 
single variable. This function is described as 

F. = f 1 (x) = x 3 -5x 2 -20x (9) 

It is required to find the maximum value of this function 
within an assumed range of -6<x<6. The algebraic calculation 
shows that the maximum value of this function is about 
15.4564 at x= -1.4064. 

In this work, the SSU approach is tested to find the 
optimum fitness value. Fig. 5 shows one epoch as an example 
on how SSU search for the best fitness. The obtained results 
for the 500 epochs are summarized in table 1 . 
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The maximum calculated value of/ 2 is 0.5635 at x= 0.1932. In 
this test, we first examined the following approaches: SSU, 
MSU with two sonar units, and MSU with three sonar units. 
Each approach tested using Fixed and Rand techniques 
respectively. The obtained results are summarized in table 2. 

Table 2 
Sum mery of the obtained results of/ 2 using SSU and MSU 



Fig. 5. SSU search for optimum fitness 

Table 1 
Summery of the obtained results of/) using SSU 



Max obtained fitness 

X 


15.4564 


-1.4064 


Avg(F„,„) 


15.4294 


Avg. no. of iterations 


50.2 


Tl 


99.8% 


Pi 


99.8% 


P-' 


100% 


\\E d \\ 


0.003 



The results of this test show that the best obtained fitness 
matches the maximum calculated fitness with high efficiency. 
Fig. 6 shows the obtained solutions, in which each dot in this 
figure represents an obtained fitness. In this test most of the 
obtained values are very close to each other, and some of them 
are equal, thus they appear in this figure as overlapped dots. 
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Fig. 6. Obtained solution of/; using SSU 

Although the test results of using SSU are good, but it is 
not guaranteed to find the global optimum solution for 
complex problems with wide state space. 

B. The second used function is a fifth order polynomial of a 
single variable described by (10). It is also required to find the 
max value of this function within the range of -6<x<6. 

(.x) jx -40 5 x -5 .2 x -12 x 2 +5.5x (10) 





SSU 


MSU (2 units) 


MSU (3 units) 




Fixed 


Rand 


Fixed 


Rand 


Fixed 


Rand 


Max(F obt ) 

X 


0.5635 


0.5635 


0.5635 


0.5635 


0.5635 


0.5635 


0.1932 


0.1932 


0.1932 


0.1932 


0.1932 


0.1932 


Avg (F obl ) 


0.5560 


0.5536 


0.5587 


0.5585 


0.5625 


0.5628 


Avg. no. of 
iterations 


53.3 


54.7 


51 


53.7 


53.7 


56.7 


n 


98.67 


98.2% 


99.1% 


99.1% 


99.82% 


99.87% 


Pi 


85.2% 


81.2 


91% 


93.8% 


99.6% 


99.8% 


P2 


90.8% 


90.4% 


95.6% 


95.8% 


99.8% 


100% 


IIEJI 


7x1 O 4 


1x10 3 


5x10 4 


1.2x10 3 


1.2xl0 4 


7.9xl0 5 



The obtained solutions of f 2 using MSU approach with three 
sonar units and Rand technique are shown in the three parts 
of Fig. 7, in which, each part represents one search unit. 
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Fig. 7. Obtained solution of f 2 using MSU with three sonar units 

The test of the SSU approach shows low performance. This 
performance can be improved by using the SSM approach, in 
which a momentum term \i is added to the length of the 
transmitted beams. By applying a momentum (a.=0.9 and 
solving for f 2 using both Fixede and Rande techniques, the 
performance is significantly increased to be 100%, with much 
better Euclidean distance as shown in table 3. 

Table 3 
Results qf/ 2 using SSU and SSM 





SSU 


SSM 




Fixed 


Rand 


Fixed 


Rand 


Max(F ofa ) 

X 


0.5635 


0.5635 


0.5635 


0.5635 


0.1932 


0.1932 


0.1932 


0.1932 


Avg (F obl ) 


0.5560 


0.5536 


0.5634 


0.5634 


Avg. no. 

of 
iterations 


53.3 


54.7 


SSU+ 
46.8 


SSU+ 

47 


n 


98.67 


98.2% 


99.98% 


99.98% 


P; 


85.2% 


81.2 


100% 


100% 


P-' 


90.8% 


90.4% 


100% 


100% 


\\E d \\ 


7.0x10 4 


lxlO 3 


4.2x10" 


7.9x10" 
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The obtained fitness of f 2 using SSU is shown in part (a) of 
Fig. 8, while part (b) shows the results of using SSM, in 
which, the obtained fitness are constrained to be very close to 
the optimum solution. 
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Table 4 
Test results of solving/; using SSU, SSM and MS U 
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Fig. 8. Obtained fitness of f 2 (a) using SSU (b) using SSM 



C. The third tested function is a polynomial with two variables 
described by (1 1) and shown in Fig. 9. 

F i = f 3 (x,y) = x 3 -5x 2 -2.04y 2 +4y (11) 

The ranges of the solution space for this function are taken 
to be -3<x<3, and -3<y<3. The maximum calculated value of 
f 3 is 1.9608 at x=0 and y=0.9809. 

The three proposed approaches are tested for the 
convergence toward the maximum fitness of f 3 . The obtained 
results are summarized in table 4. In this test, although the 
efficiency of the SSU approach is good but its performance is 
not accepted in solving such a problem. The alternative is to 
use either the SSM approach which gives much better 
performance, or to use the MSU approach with not more than 
three search units, in which the performance is increased to be 
about 100% with high overall efficiency. The distribution of 
the x, y values for the obtained fitness using SSU and SSM are 
shown in Fig. 10, while Fig. 11 shows this distribution when 
using the MSU approach. 






SSU 


SSM 


MSU 
(3 units) 




Rand 


Rand 


Rand 


Max(F obt ) 

X 

y 


1.9607 
-0.0019 
0.9869 


1.9608 


0.9826 


1.9608 


0.9826 


Avg (F obl ) 


1.887 


1.9264 


1.9505 


Avg. no. of 
iterations 


33 


SSU+ 
11 


55 


n 


96.2% 


98.2% 


99.48% 


P/ 


30% 


85% 


99.8% 


P-> 


60% 


98.2% 


100% 


IIErfll 


3.7xl0 3 


1.7x10-' 


6xl0~ 4 
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Fig. 10. Distribution of x, y values of/j fitness (a) using SSU, (b) using SSM 
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Fig. 9. Polynomial function (/}) with two variables 



Fig. 1 1 . Distribution of x, y values of/; fitness using MSU approach with 
three search units 



D. The fourth case tests an exponential function with two 
variables. This function is described by (12). The ranges of 
the solution space are taken to be between -2 to +2 for both x 
and y as shown in Fig. 12. 

7 t=f &,y) = xe { - xl - yl) (12) 

The maximum calculated value for f 4 is 0.4289 at x=0.7072 
and y=0. The obtained results of using SSU, SSM, and MSU 
(with three points) are contained in table 5. The three 
approaches converged toward the optimum point with 
different performances. The performance of using SSU in 
solving functions like/ 4 is very low. Rather than the use of this 
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approach its better to apply either the SSM approach or the 
MSU approach in which both have a performance of 100% 
with less Euclidean distance. The distribution of the x, y 
values for the obtained solutions using the above mentioned 
approaches are shown in Fig. 13 and Fig. 14. 




Fig. 12. Exponential function <f 4 ) with two variables 

Table 5 
Test resul ts of/, using SSU, SSM a nd MSU 





SSU 


SSM 


MSU 
(3 units) 




Rand 


Rand 


Rand 


Max(F o6f ) 

X 

y 


0.4289 
0.7086 
-0.0071 


0.4289 
0.7086 
-0.0071 


0.4289 
0.7083 
-0.0006 


Avg (F obt ) 


0.412 


0.4283 


0.4277 


Avg. no. of 
iterations 


21 


SSU+ 
29.2 


62 


T| 


96% 


99.97% 


99.7% 


Pi 


30% 


100% 


100% 


P2 


53% 


100% 


100% 


\\E d \\ 


8.7xl0~ 4 


5.2x10" 


8.1xl0 5 



E. The last test in this work considers a function with several 
optimum points and checks the ability of the proposed 
algorithm to converge towards these points. A trigonometric 
or a periodic function is a good example for such a case, in 
which these types of functions repeat their values in regular 
intervals or periods. The selected function for this test is: 



F t = f 5 (x) = sin(2x) - cos(jt) 



(13) 





Fig. 14. Distribution of x, y values of/4 fitness using MSU approach with 
three search units 



The solution range is assumed to be between -2n to 2n. 
Within this interval, the function f 5 has two optimum values of 
about 1.76017 at x=-2.5067 and x=3.7765 as shown in Fig. 15. 




Fig. 15. Periodic function f/j) with two global optimum values 

The tested approach is the MSU with two sonar units. As 
mentioned before, in this approach, the search units are 
working in parallel in the same state space. The obtained 
results showed that, either both of the search units converged 
towards the same optimum point, or each unit converged 
toward a different optimum point, but in general, the algorithm 
observed the two global optimum points in high performance 
levels. The test results are as shown in table 6. It is found that 
the overall average fitness is very close to the optimum value 
(r| = 99.68%) and a performance between 98.6% and 100% 
with acceptable Euclidean distance. The obtained fitness for 
this test is shown in Fig. 16. 

Table 6 
Obta ined results of/ 5 using MSU with two units 



Fig. 13. Distribution of x, y values of/4 fitness using SSU and SSM 
approaches 



Max(F o6f ) 
X] 

Xt 


1.76017 
-2.5070 
3.7765 


Avg (F obl ) 


1.7544 


Avg. no. of iterations 


44 


T| 


99.68% 


Pi 


98.6% 


P-' 


100% 


\\EJ\ 


5.5xl0 5 
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- In the proposed algorithm, a single epoch with number 
of iterations = 100 is considered in solving each 
function. 

- In GA algorithm, the default setting of the MATLAB 
built in function "ga" is considered, in which the 
maximum allowed number of generations before the 
algorithm halts is = 100. 

As it is seen from table 7, the calculated execution times 
using the proposed algorithm are much less than those of the 
GA algorithm. 



Fig. 16. Obtained fitness off 5 using MSU with two search units 

In order to evaluate the proposed algorithm, a comparison 
with genetic algorithm has been made, in which, the obtained 
fitness and the execution time for both of the algorithms are 
tested using the above mentioned five functions. The used 
platform for the two algorithms is "MATLAB® R2010b 32-bit 
(Win32)". The results of the comparison are as declared in 
table 7. 

In this comparison, the obtained fitnesses for the first four 
testbed functions are approximately the same in both of the 
algorithms. In function f 5 , shown in Fig. 15, it is clear that 
there are two global and two local optimum points within the 
considered range space. The comparison showed that the 
obtained result of solving f5 using the MSS (with 2 sonar 
units) is much better than the result obtained by using GA. In 
which, the MMS algorithm observed the two global points as 
its best fitness, while the obtained fitness using GA algorithm 
is one of the local optimum. 

Table 7 
Comparison between the proposed algorithm and ga algorithm 



Function 


Algorithm 


Fob, 


X 


y 


Execution 
time 

(msec) 


fl 


SSU 


15.4564 


-1.40640 


— 


1.7 


GA 


15.4562 


-1.40180 


- 


116 


P 


SSM 


0.56350 


0.19320 


— 


3.2 


GA 


0.56350 


0.19320 


— 


127 


P 


SSM 


1.96080 


0.00000 


0.98190 


3 


GA 


1.96080 


0.00000 


0.98037 


119 


f4 


SSM 


0.42890 


0.70860 


-0.0071 


2.7 


GA 


0.42890 


0.70700 


0.00020 


123 


f5 


SSM 


1.76017 
1.76017 


-2.50674 
3.77650 


- 


2.6 


MSU 
with 2 
units 


1.76017 
1.76017 


-2.50674 
3.77650 


- 


3.5 


GA 


0.36900 


1.00300 


- 


112 



V. 



Conclusion 



The other parameter that takes place in this comparison is 
the execution time required to solve each function. This 
comparison based on the following considerations: 



Intelligent algorithms are, in many cases, practical 
alternative techniques for solving a variety of challenging 
engineering problems. These techniques are, in general, 
attempts to mimic some of the processes taking place in 
natural evolution. This paper introduces a new intelligent 
algorithm with three search approaches depending mainly on 
the principles of how bat sonar can detect and capture its 
target. The first approach uses a single sonar unit in its search 
process. While the second one uses multisearch units working 
in parallel. This approach has been developed to reduce the 
execution times that are associated with the use of the first 
approach for finding near-optimal solutions in large search 
spaces and to find better solutions in larger problems. The 
third approach uses a single search unit with a momentum 
term added to the beam length. The three approaches are 
tested on different types of functions, such as; polynomial, 
exponential, and trigonometric or periodic functions. The 
search results show that the proposed algorithm approximately 
recognized all the optimum values with a reasonable 
efficiency and "acceptable to high" performance depending on 
the complexity of the problem and the number of optimum 
points that exist in the problem. 

Although the initial values of the main parameters are 
selected randomly, some complex problems may need a 
heuristic signal to decrease the execution time and to find the 
optimum solution with high performance. This signal can 
mainly be used for the selection of the initial value of the 
beam length. 

A comparison between the proposed algorithm of this 
paper and GA algorithm showed that the proposed algorithm 
is much better in solving problems having a local optimum. 
On the other hand, the required execution times for the 
proposed algorithm are much less than that of the GA 
algorithm for all the tested functions. 

From the optimization point of view, the main advantage of 
the approaches introduced in this paper is that they do not 
have much mathematical requirements. All they need is an 
evaluation of the objective function. As a result, they can be 
easily applied to solving a wide class of scientific and 
engineering optimization problems. 
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Abstract — Fuzzy logic control (FLC) is a useful modeling tool that 
can handle the uncertainties and nonlinearities of modern control 
systems. However the main drawbacks of FLC methodologies is 
challenging for selecting the optimum tuning parameters. The set 
of parameters that can be altered to modify the controller 
performance are fuzzy rules and the parameters of membership 
functions for each input variable. In all cases, the correct choice 
of membership functions of the fuzzy sets plays an essential role 
in the performance of FLC. This paper proposes a method for 
finding the optimum membership function parameters of a fuzzy 
system using particle swarm optimization (PSO). As the set of 
nonlinear differential equations of an aerobic unit for wastewater 
treatment is a multivariable nonlinear problem, the combination 
of PSO and FLC named PSO-FLC controller is proposed for 
further improvements of the system response in both the 
transient and steady state response. To establish its efficiency, 
the proposed technique was employed to enhance the triangle 
membership functions of the fuzzy model of a nonlinear sludge 
activated system; the results show that the optimized 
membership functions (MFs) offered better performance than a 
fuzzy model with heuristically described MFs 



Keywords-component; PSO; FLC controller; 
treatment process; 



Wastewater 



I. 



Introduction 



Several research trends concentrated on providing simple 
and easy control algorithms that faces the problem of 
increasing complexity of the controlled systems [1]. As, the 
systems involved in practice are in general complex and time 
variant, with delays and nonlinearities and often with poorly 
defined dynamics, nonlinear controllers are often developed. 
The main difficulty in designing nonlinear controllers is the 
lack of a general structure [2]. In addition, most linear and 
nonlinear control solutions developed during the last three 
decades have been based on precise mathematical models of 
the systems. Most of those systems are difficult to be described 
by conventional mathematical relations; hence, these model- 
based design approaches may not provide satisfactory solutions 
[3]. This motivates the interest in using FLC which is based on 
fuzzy logic theory [4,5] and employ a mode of approximate 
reasoning that resembles the decision making process of 
humans. The behavior of FLC is easily understood by a human 
expert, as knowledge is expressed by means of intuitive, 
linguistic rules. In contrast with traditional linear and nonlinear 



control theory, a FLC is not based on a mathematical model 
and is widely used to solve problems under uncertain and 
vague environments with high nonlinearities [6, 7]. Since their 
advent, FLCs have been implemented successfully in a variety 
of applications [8-11]. Most FLCs are designed based on the 
experience or knowledge of experts. However, it is often the 
case that no expert is available. In this case, the major task is 
to determine fuzzy rule base and membership function of input 
and output variables which are usually found by using the trial 
and-error method [12]. An optimal design of control rules and 
membership functions is usually desired as it affect on the 
performance of fuzzy logic based controller. Evolutionary 
algorithms are getting popular because of their ability to find 
global minima in both continuous and non-continuous domain. 
Most of evolutionary algorithms regarding tuning the 
membership function parameters of FLC have been studied 
extensively in the literature. Many random search methods, 
such as genetic algorithm [13-15], evolutionary computational 
techniques [16] and simulated annealing [17] have recently 
received much interest for achieving high efficiency and 
searching global optimal solution in problem space. 

PSO has been a hotspot of research and promising 
technique for real world optimization problems [18]. Due to the 
simple concept, easy implementation and quick convergence, 
nowadays PSO has gained much attention and wide 
applications in different fields. PSO algorithm is especially 
useful for parameter optimization in continuous, multi- 
dimensional search spaces. PSO technique is a stochastic 
search through an n-dimensional problem space aiming the 
minimization or maximization of the objective function of the 
problem. Pulasinghe et al. [19] developed fuzzy-neural 
networks (FNNs) for navigation of a mobile robot and for 
motion control of a redundant manipulator. They employed 
PSO to train the FNNs that can accurately output the crisp 
control signals for the robot systems. Mukherjee et al. [20] 
studied regarding the determination of optimal PID gains for 
automatic voltage regulator (AVR). Wong et al. [21] proposed 
a motion control structure with a distance fuzzy controller and 
an angle fuzzy controller for the two-wheeled mobile robot. 
They used PSO algorithm to automatically determine 
appropriate membership functions of these two fuzzy systems. 
The work in [22] proposed a method for finding the optimum 
membership functions of a fuzzy system using PSO algorithm 
to design a controller for a continuous stirred tank reactor 
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(CSTR) with the aim of achieving the accurate and acceptable 
desired results. Also, in [23] an intelligent speed controller for 
DC motor is designed by combination of the fuzzy logic and 
PSO algorithm. In [24], a novel adaptive fuzzy robust 
controller with a state observer approach based on the hybrid 
particle swarm optimization-simulated annealing (PSO-SA) 
technique for a class of multi-input multi-output (MIMO) 
nonlinear systems with disturbances is proposed. PSO-SA is 
used to adjust the fuzzy membership functions. The proposed 
algorithm consists of the adaptive fuzzy robust method, the 
individual enhancement scheme and PSO-SA structure which 
generate new optimal parameters for the control scheme. 

In this paper, the hybrid of PSO and FLC named PSO-FLC 
algorithm is proposed for the optimum design of membership 
function of FLC controller to the biological aerobic wastewater 
treatment process for further improvements of system response 
in both the transient and steady state response. The 
performance of the system is compared with the standard FLC 
controller. Experimental studies on tuning the parameters of 
membership function of FLC to the wastewater treatment 
process show that the system has higher fitness and better time 
response than the standard FLC. 

The rest of paper is organized as follows: section 2 presents 
the biological wastewater treatment process and its dynamic 
model. An overview of the standard PSO is presented in 
section 3. A brief description of the FLC and the proposed 
PSO-FLC controller to wastewater treatment process in 
addition to the error function used for evaluating the 
performance of the proposed algorithm in optimizing the 
parameters of membership function of FLC are described in 
details in section 4. Experimental results and discussions are 
presented in section 5. Finally, section 6 concludes the whole 
work. 



II. The Biological Wastewater Treatment with an 
Activated-Sludge process 

The most common method for wastewater treatment is the 
biological processes in which the influent wastewater goes 
through several stages in which different compound are 
removed out of the wastewater. An important part of the 
municipal wastewater treatment is the removal of organic 
matter which is dissolved in wastewater. The removal of 
organic matter by a biological process, such as the suspended 
growth treatment process is an aerobic process which takes 
place in the aeration tank, in where the wastewater is aerated 
with oxygen using an activated sludge. The activated sludge 
process is probably the most versatile and effective of all waste 
treatment processes [25] and is usually constituted by a 
bioreactor (the aeration reactor) and a settler (secondary 
clarifier) as shown in figure 1 . 
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,r T 
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£ 



Effluent 



Aeration 
Tank 



Secondary Clarifier 



Settler 



Recycle 




Activated Sludge 



Waste Activated 
Sludge 



Excess 
sludge to 
anaerobic 
digestion 



Figure 1 . Schematic diagram of Aerobic treatment unit 

The oxygen is injected in the aerator by compressed air and 
the suspended micro-organisms are separated completely in the 
settler. In this process, microorganisms in the aeration tank 
convert dissolved organic material in wastewater to into their 
own biomass (microbial biomass) and carbon dioxide (CO2). 
Both of organic nitrogen and organic phosphorus is converted 
to ammonium ion or nitrate and orthophosphate. The microbial 
cell matter formed as part of the waste degradation processes is 
normally kept in the aeration tank until the microorganisms are 
past the log phase of growth, at which point the cells flocculate 
relatively well to form settle-able solids (flocks). These solids 
collect in the bottom part of a settler and fraction of them is 
discarded. Part of the solids, the return sludge, is recycled to 
the head of the aeration tank and comes into contact with fresh 
sewage. The combination of a high concentration of "hungry" 
cells in the return sludge and a rich food source in the influent 
sewage provides optimum conditions for the rapid degradation 
of organic matter. The activated sludge process removes 
organic carbon from water by conversion to CO2 and by 
incorporation into biomass [26]. The disposal of waste sludge 
from an activated sludge plant can be a problem, primarily 
because it is only about 1% solids and contains many 
undesirable components. Normally, partial water removal is 
accomplished by drying on sand filters, vacuum filtration, or 
centrifugation. 

A. Dynamic Model of Activated Sludge process 

The mass balance on the bioreactor and the settler gives the 
following set of nonlinear differential equations: 

X'(t) = fJ(t)X(t) - D(f)(l + r)X(t) + rD(t)X r (t) (1) 

S'(t) = -/j(t)X(t) I Y - D(t)(l + r)S(t) + D(t)S in (2) 



C* (?) = -K oJ u(t)X(t) I Y - D(t)(l + r)C(t) 
+ K La (t){C s -C(t)) + D(t)C in 

X' (t) = D(00 + r)X(t) - D(t){j3 + r)X r (t) 



(3) 



(4) 
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TABLE I. Kinetic parameters 



X(t): the state variable representing the biomass, 
S(t): the state variable representing the substrate, 

X r (t): the state variable representing the recycled biomass, 
C(t): the state variable representing the dissolved oxygen, 

D(t): the dilution rate (D(t) = q(t)/V) where q(t) and V are 

the influent flow rate and the inner aerator volume 

respectively, 

S; n : substrate concentrations in the feed stream 

On : dissolved oxygen concentrations in the feed stream 

K La (t): Oxygen transfer rate coefficient 

r and |3 are the ratio of recycled flow to influent flow and 

the ratio of waste flow to influent flow respectively. 

The kinetics of the cell mass production are defined in 
terms of the specific growth rate u and the yield of cell mass Y; 
the term K is a constant, Cs is the maximum dissolved oxygen 
concentration. In this study, it is assumed that the constants (Cs, 
Ko, Y) and the parameters (r, (3) are known. The specific 
growth rate u(t) is well defined and modeled by Olsson model, 
depending on substrate and dissolved oxygen concentrations as 
follows: 



M(f) = VmaxS(0/(K s + S(t))(K c + C(t)) 



(5) 



Where: (a max is the maximum specific growth rate, K s is the 
affinity constant and K c is the saturation constant [26, 27]. 

B. Controller Design for Activated Sludge 

In this paper, the development of the best controller for 
activated sludge wastewater treatment process based 
mathematical insight is considered. Two main targets in 
treatment wastewater process must be achieved; the reduction 
of the organic matter concentration (pollutant substrate S(t)) 
and the dissolved oxygen concentration (air flow rate W(t)) 
must be kept above a critical level to maintain the 
microorganism activity. This quantity appears in equation (3) 
through the oxygen transfer rate coefficient K^ (t) as follows: 



Klu (0 = W(t)a where (a : cons tan t >- 0) 



(6) 



The objective of the control here is to regulate the substrate 
S(t) and the dissolved oxygen concentrations C(t) at desired set 

points S and C respectively by acting on the dilution rate 

D(t) and on the aeration rate W(t). The typical values of kinetic 
parameters and initial conditions are given in table 1 and table 
2, [26]. 



Y = 0.65 


/"max = 015h ' 


r = 0.6 


Ks = 100 mg.l ' 


/? = 0.2 


Ko = 0.5 


a =0.018 


Cs=10mg.r' 


Kc=2 mg.l ' 





TABLE II. 



INTIAL CONDITIONS 



X(0) = 215 mg.l ' 


C(0) = 6 mg.l ' 


S(0) = 55 mg.l" 1 


S in = 200 mg.1" 1 


Xr(0) = 400 mg.l ' 


C in = 0.5 mg.l ' 



To regulate the substrate and the dissolved oxygen 

concentrations at the set points S and C respectively, two 

controllers are used. The first controller will act on the air flow 
rate W(t) to maintain C(t) at the required set point while the 
second controller will act on the dilution rate D(t) to maintain 
substrate concentration S(t) at the required set point. In our 
paper, the output of each controller depends on both the error 
(e) which is defined as the difference between the set point and 
the controlled variable and error derivative (derror) for efficient 
control. The main objective of any designed controller is to 
maintain the magnitude of the error as small as possible to 
improve the steady state response. On the other hand the 
controller should improve the transient response by reducing 
the settling time and the rise time, and eliminating or reducing 
the overshoots without causing sluggish response. In the 
following sections, an overview of PSO and the complete 
activated sludge control system using FLC is introduced, as 
well as PSO for optimum design of membership function of 
FLC are investigated. 

III. An Overview of PSO 

PSO is mainly inspired by social behavior patterns of 
organisms that live and interact within large groups. In 
particular, PSO incorporates swarming behaviors observed in 
flocks of birds, schools of fish, or swarms of bees. PSO refers 
to a relatively new family of algorithms that may be used to 
find optimal or near to optimal solutions to numerical and 
qualitative problems. PSO was firstly proposed by Eberhart and 
Kennedy [2], and it is initialized with a group of random 
particles (solutions) and then searches for optima by updating 
generations. Each particle in the swarm is updated by two 
"best" values. The first one is the best solution (fitness) it has 
achieved so far and it is called Pbest. The other best value is 
the global best in the whole swarm and called gbest . After 
finding the two best values, the particle updates its velocity and 
positions using the following equation (7) and (8). 

v(k + 1) = w * v(k) + cl * randQ *(pbest(k)-x(k)) + c2* randQ * (gbest(k) - x(k)) (7) 

x(k + l)=x(k) + v(k+l) (8) 
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Where: v(k+l), v(k) are the particle velocity in iteration 
number k+1, k respectively, x(k+l), x(k) are the particle 
position in iteration number k+1, k respectively. Rand is a 
random number between (0, 1). cl is called the self confidence 
and usually it takes values in the range (1.5 to 2.0), and c2 is 
called the swarm confidence and usually takes the value in the 
range (2.0 to 2.5). w is the inertia weight which is used to 
achieve a balance in the exploration and exploitation of the 
search space and plays very important role in PSO convergence 
behavior. The inertia weight is dynamically reduced from 1.0 
to near in each generation based on the following equation: 



(9) 
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In the presented work, two fuzzy logic controllers are used; 
each one of them will determine its output according to error 
and derivative of error (derror). The block diagram of the 
complete activated sludge control system using FLC is shown 
in Figure (3) 



Where: iter m „ is the maximum number of iterations, and iter 



is the current number of iteration. w„. 



and 



w,„ 



the 



maximum and minimum values of inertia weight. The Position 
of each particle is updated using its velocity vector as shown in 
Equation (8). In this paper PSO algorithm is proposed for the 
optimum design of the parameters of membership functions of 
FLC which is described in the following section. 

IV. FLC CONTROLLER 



FLC is popular technique that has seen increasing interest 
in the past decades since it has a linguistic based structure and 
its performance are quite robust for non-linear systems. FLC 
has three main components such as fuzzification, fuzzy 
inference engine (decision logic), and defuzzification stages. 
The block diagram of FLC process is shown in Fig. 2. 




c 



Rule Base 

Inference 
Engine 




U 



Figure 2. Fuzzy Logic process 

The first block in the figure is the fuzzification which 
converts each element of input data to degrees of membership 
by a lookup in one or several membership functions. The rule 
base and inference base have the capability of simulating 
human decision-making. Both of rule base and inference 
engine based on fuzzy concepts and the capability of inferring 
fuzzy control actions employing fuzzy implication and the rules 
of inference in fuzzy logic. Rules are in the form of if-then 
rules (antecedent and consequent). The membership functions 
of the fuzzy sets and the fuzzy control rules have a big effect 
on control performance [29-31]. The third operation is called as 
defuzzification. The resulting fuzzy set is defuzzified into a 
crisp control signal. There are five defuzzification methods: 
centroid, bisector, middle of maximum, largest of maximum, 
and smallest of maximum [31]. 



■icrl— - 





e 






Figure 3. Simulink model of FLC for Activated sludge system 

The two controllers mentioned above are: controllerl to control 
the dissolved oxygen concentration and controlled to control 
mainly the substrate concentration. In the following section, 
each controller will be introduced with more details. 

A. Controller 1 

This controller is described by the membership functions 
of error and error derivative of the first input (input 1) and its 
corresponding output air flow rate W(t). The values of the error 
and derror are scaled to the interval of [-3 3] and [-15 15] for 
the first input (inputl). The FLC inputs are composed of the 
five linguistic terms which are: Negative Big (--), Negative 
Medium (-), Zero (0), Positive Medium (+) and Positive Big 
(++) as described in Figure 4. Both the outputs of the two FLC 
W(t) and D(t)) are partitioned into five fuzzy sets which are 
(VS, S, M, B, and VB). 
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Figure 4. The normalized Membership function of fuzzy sets of inputl and 
its output for first controller before tuning. 



23 



http://sites.google.com/site/ijcsis/ 
ISSN 1947-5500 



The rules which manage the relation between the two 
and the corresponding output of the first controller are gi 
table 3. 
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TABLE IV. The rules of the second controller 



inputs 
lven in 



TABLE III. 



Rules of the first controller 



1. If (error is --) and (derror is --) then (W is VS) (1) 

2. If (error is --) and (derror is -) then (W is VS) (1) 

3. If (error is --) and (derror is 0) then (W is VS) (1) 

4. If (error is --) and (derror is +) then (W is S) (1) 

5. If (error is --) and (derror is ++) then (W is M) (1) 

6. If (error is -) and (derror is --) then (W is VS) (1) 

7. If (error is -) and (derror is -) then (W is VS) (1) 

8. If (error is -) and (derror is 0) then (W is VS) (1) 

9. If (error is -) and (derror is +) then (W is M) (1) 

10. If (error is -) and (derror is ++) then (W is B) (1) 

11. If (error is 0) and (derror is --) then (W is VS) (1) 

12. If (error is 0) and (derror is -) then (W is S) (1) 

13. If (error is 0) and (derror is 0) then (W is VB) (1) 

14. If (error is 0) and (derror is +) then (W is B) (1) 

15. If (error is 0) and (derror is ++) then (W is VB) (1) 

16. If (error is +) and (derror is --) then (W is S) (1) 

17. If (error is +) and (derror is -) then (W is M) (1) 

18. If (error is +) and (derror is 0) then (W is VB) (1) 

19. If (error is +) and (derror is +) then (W is VB) (1) 

20. If (error is +) and (derror is ++) then (W is VB) (1) 

21. If (error is ++) and (derror is --) then (W is M) (1) 

22. If (error is ++) and (derror is -) then (W is B) (1) 

23. If (error is ++) and (derror is 0) then (W is VB) (1) 

24. If (error is ++) and (derror is +) then (W is VB) (1) 

25. If (error is ++) and (derror is ++) then (W is VB) (1) 



1. If (error is --) and (derror is --) then (D is B) (0.1) 

2. If (error is --) and (derror is -) then (D is VS) (0.1) 

3. If (error is --) and (derror is 0) then (D is VS) (0.9) 

4. If (error is --) and (derror is +) then (D is S) (0.9) 

5. If (error is --) and (derror is ++) then (D is M) (0.1) 

6. If (error is -) and (derror is --) then (D is VS) (0.1) 

7. If (error is -) and (derror is -) then (D is VS) (0.1) 

8. If (error is -) and (derror is 0) then (D is S) (0.9) 

9. If (error is -) and (derror is +) then (D is M) (0.1) 

10. If (error is -) and (derror is ++) then (D is B) (0.1) 

11. If (error is 0) and (derror is --) then (D is VS) (0.1) 

12. If (error is 0) and (derror is -) then (D is S) (0.1) 

13. If (error is 0) and (derror is 0) then (D is M) (0.9) 

14. If (error is 0) and (derror is +) then (D is B) (0.1) 

15. If (error is 0) and (derror is ++) then (D is VB) (0.1) 

16. If (error is +) and (derror is --) then (D is S) (0.1) 

17. If (error is +) and (derror is -) then (D is M) (0.1) 

18. If (error is +) and (derror is 0) then (D is B) (0.9) 

19. If (error is +) and (derror is +) then (D is VB) (0.1) 

20. If (error is +) and (derror is ++) then (D is VB) (0.1) 

21. If (error is ++) and (derror is --) then (D is M) (0.1) 

22. If (error is ++) and (derror is -) then (D is B) (0.1) 

23. If (error is ++) and (derror is 0) then (D is VB) (0.9) 

24. If (error is ++) and (derror is +) then (D is VB) (0.1) 

25. If (error is ++) and (derror is ++) then (D is VB) (0.1) 



In our paper, the correct choice of membership functions of the 
fuzzy sets plays an essential role in the performance of our 
FLC which is developed by using PSO for tuning its 
membership function as described in the following section. 



B. Controller 2 

This controller is described by the membership functions of 
error and error derivative of the second input (input2) and its 
corresponding output the dilution rate (D(t)) as shown in Figure 
5. The values of the error and derror are scaled to the interval 
of [-7.5 7.5] and [-15 15] for the second input (input2). The 
rules which manage the relation between the controller's inputs 
and output are given in table 4. 
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Figure 5. The normalized Membership function of fuzzy sets of input2 and 
its output for second controller before tuning. 



C. The proposed algorithm of PSO-FLC 

As described before, each FLC has three variables; two 
inputs (error and derror) and one output with 5 fuzzy sets for 
each variable which corresponding to 15 MFs and 25 rules for 
each controller. Each fuzzy set is triangle shape and is 
represented by three parameters which are x-coordinates of the 
three vertices of the triangle. Consequently, there are 45 
parameters for each controller, means 90 parameters in this 
study for the two controllers to be optimized. PSO searches all 
of the antecedent and consequent parameters (inputs and 
outputs controller) in 90 dimensional spaces. The order of a 
particle is shown as the following: 

P ! =a n b n c n «1 5'l5''l 5. a 2 1^2^21 «25 fc 25 c 25. a 31^1 c 3I "35^35. 

"41 & 41 e 4l "45^45. «5l fo 51 e 51 a 55 fe 55 c 55.«61 fo 61 e 61 «65 fo 65 c 65 ( 10 ) 

Where: b, a, and c represent the center and the left and right 
deviation from the center of triangle membership (x-coordinate 
of the three vertices) as shown in figure 6. In the above 
equation, the first line and the second line constitute the 
parameters of the first controller and the second controller, 
respectively, which are 2 inputs and one output with 15 MFs 
for each controller. The initial values of the first particle are 
generated with the normal values by equally dividing the range 
of each input and output on 5 fuzzy sets values, while the 
remaining particles are randomly generated in the first 
generation by associating an interval of performance for each 
parameter in the particle. Each interval of performance will be 
the interval of adjustment for each correspondent variable. 
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Figure 6. The triangle membership function 

For the three variables a, b and c of each fuzzy set, the intervals 
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Figure 7. Tuning process of FLC parameters with PSO 
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The most crucial step in applying PSO is to choose the best 
membership parameters by searching the best value of cost 
function which is used to evaluate the fitness of each particle. 
During tuning process with PSO, two different cost functions 
are used such as Mean of Squared Error (MSE) and integral of 
Absolute Magnitude of the Error (IAE) to investigate the 
performance of the proposed technique. The fitness of each 
particle in the swarm is evaluated depending on the two 
following objective functions: 

- Mean of the Square of the Error (MSE) 

I MSE = -he 1 (t)) 2 + (e 2 (t)) 2 (11) 

n t =0 

-Integral of Absolute Magnitude of the Error (IAE) 

I IAE = J|«i(0r*+|«2(0|* (12) 

t=0 

Where: <?i and e 2 are the errors between system inputl and 

input2 and their corresponding outputs W(t) and D(t) calculated 

over a time interval t respectively, and n is the number of 

samples. The effectiveness of the proposed PSO-FLC 

algorithm in comparison with the FLC without tuning is tested 

using the above two performance indices. The plant system 

with the tuned FLC parameters using PSO is shown in figure 7. 

Membership functions Tuning by using PSO and the two 

objective functions MSE and IAE are shown in the figures 8 

and 9 
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Figure 8. Tuning membership functions of the two FLC controllers using 

MSE 
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algorithm, experiments have been carried out for optimal 
tuning of fuzzy controller to wastewater treatment process. The 
performance results of FLC controller tuned by PSO using 
IAE, and ISE performance indices are compared with the 
standard FLC. The cost function is calculated as an average 
over 10 runs for 20 generations. The resulted time response of 
two outputs system using the two performance indices are 
shown in Figures 10-13 respectively. Also, the cost functions 
for the two performance indices are shown in Figures 14-15. 
Tables 6-9 give comparison of the transient response 
characteristics for the two outputs C(t) and S(t) with PSO-FLC 
controller using MSE, and IAE performance indices and the 
standard FLC. 



-2 2 

error 



-10 10 
derror 



50 100 
W 



nput2 




0.05 0.050.1 
D 



Figure 9. Tuning membership functions of the two FLC controllers using 

IAE 



V. Simulation Results of PSO-FLC 

To test the performance of the system for sudden change 
situation and to check the robustness of the controllers, two set 
points for each controlled variable are applied in interval 100 
hour (h). The set points represent the upper and lower bound of 
the controlled variable as depicted in table 5. 



TABLE V. 



The set points for both substrate and dissolved 

OXYGEN 



Time interval 


Dissolved oxygen set 
points C* 


substrate set points 

S* 


0<t<50h 


5mg/l 


50mg/l 


50<t<100h 


6.5mg/l 


30mg/l 



6.5 

5? 6 
E 
O 5.5 
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Figure 10. The output value of C(t) with PSO_FLC and standard FLC using 

MSE 
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Figure 1 1 . The output value of S(t) with PSO-FLC and standard FLC using 

MSE. 



The actual and the desired values for both the dissolved 
oxygen concentration C(t) in mg/1 and the substrate 
concentration S(t) in mg/1 versus the time in interval 100 hour 
are presented in the following figures. The set point for each 
controller will take the shape of step representing the controlled 
variable bounds. To verify the efficiency of the proposed 
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TABLE VI. Transient response characteristics of dissolved 

OXYGEN CONCENTRATION AND COST FUNCTION OF WASTEWATER TREATMENT 
PROCESS USING MSE CRITERIA 



- PSOIuzzy 

- fuzzylogic 



10 20 30 40 50 60 70 80 90 100 



Figure 12. The output value of C(t) withPSO-FLC and standard FLC using 

IAE 
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Figure 13. The output value of S(t) with PSO-FLC and standard FLC using 

IAE. 
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TABLE VII. Transient response characteristics of substrate 

CONCENTRATION AND COST FUNCTION OF WASTEWATER TREATMENT PROCESS 

using MSE Criteria 



MSE criterion 


FLC controller 


PSO-FLC controller 


SP=50 


SP=30 


SP=50 


SP=30 


t,(h.) 




5.2 




3 


M p 




1.9% 




0% 


t»(h.) 




7.5 




4.8 


ess 


2.4% 


2% 


1.4% 


0% 



TABLE VIII. Transient response characteristics of dissolved 

OXYGEN CONCENTRATION AND COST FUNCTION OF WASTEWATER TREATMENT 
PROCESS USING IAE 



10 12 



IAE 
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FLC controller 


PSO-FLC controller 
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Figure 14. Cost function of PSO-FLC using MSE result 



Figure 15. Cost function using of PSO-FLC using IAE 



TABLE IX. Transient response characteristics of substrate 

CONCENTRATION AND COST FUNCTION OF WASTEWATER TREATMENT PROCESS 

USING IAE 



IAE criterion 


FLC controller 


PSO-FLC controller 


SP=50 


SP=30 


SP=50 


SP=30 


t,(h.) 




5.2 




3.8 


Mp 




1.9% 




0% 


t,(h.) 




7.5 


8.07 


4.8 


ess 


2.4% 


2% 


1.3% 


0% 
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Simulation results demonstrate the superiority of PSO-FLC 
comparing with the standard FLC. As shown and comparing to 
the standard FLC, PSO-FLC has a lower overshoot also it has 
minimum settling time, and concerning the steady state error, 
PSO-FLC achieve lower error comparing with the standard 
FLC. The percentage improvements of PSO-FLC over FLC in 
terms of settling time, peak value, and the value of steady state 
error using MSE, and IAE metrics are depicted in tables 10-12 
as follows. 



TABLE X. IMPROVEMENTS IN THE SETTLING TIME OF DISSOLVED 

OXYGEN CONCENTRATION AND SUBSTRATE CONCENTRATION WITH PSO-FLC 

WITH RESPECT TO STANDARD FLC 



Performance 
criterion 


PSO-FLC controller 

with respect to 

standard FLC C 


PSO-FLC controller 

with respect to 

standard FLC S 


SP=5 


SP=6.5 


SP=50 


SP=30 


MSE 


8.6% 


63% 




36% 


IAE 


8.6% 


73.9% 


39.7% 


36% 



(IJCSIS) International Journal of Computer Science and Information Security, 

Vol. 10, No. 10, 2012 
concentration through acting on air flow rate, and another to 
control the substrate concentration through acting on the 
dilution rate. The performance of the system is compared with 
the standard FLC. The performance of the proposed algorithm 
is analyzed based on two performance indices; IAE and MSE. 
Experimental studies on tuning the parameters of membership 
functions of FLC controller for wastewater treatment process 
show the superiority of the PSO-FLC over the standard FLC in 
metric of time response characteristic and error function value. 
As for settling time, the time of PSO-FLC is (8.6%) and (73%) 
less than the time taken by classical FLC for C(t) at set-points 5 
and 6.5 respectively. Also for S(t) at set-points 50 and 30, the 
time of PSO-FLC is (41%) and (36%) less than the time taken 
by classical FLC. The maximum peak value decreased by 
(68.8%- 100%) for both C(t) and S(t), and the improvements in 
steady state error is reduced by (68% -100%) and (41%- 100%) 
for both C(t) and S(t) than the other FLC technique. 



TABLE XI. IMPROVEMENTS IN THE PEAK VALUE OF DISSOLVED OXYGEN 

CONCENTRATION AND SUBSTRATE CONCENTRATION OF PSO-FLC WITH 

RESPECT TO STANDARD FLC 



Performance 
criterion 


PSO-FLC controller 

with respect to 

standard FLC C 


PSO-FLC controller 

with respect to 
standard FLC S 


SP=5 


SP=6.5 


SP=50 


SP=30 


MSE 


68.8% 


100% 


0% 


100% 


IAE 


78.2% 


100% 


0% 


100% 



TABLE XII. IMPROVEMENTS IN THE STEADY STATE ERROR OF 

DISSOLVED OXYGEN CONCENTRATION AND SUBSTRATE CONCENTRATION WITH 

PSO-FLC WrTH RESPECT TO STANDARD FLC 



Performance 
criterion 


PSO-FLC controller 
C 


PSO-FLC controller 5 


SP=5 


SP=6.5 


SP=50 


SP=30 


MSE 




100% 




100% 


IAE 




100% 




100% 



VI. Conclusion 

The design of fuzzy logic controller depends on a set of 
parameters that can alter to modify the controller performance. 
Among these parameters are fuzzy rules and the parameters of 
membership functions for each input variable. In this paper 
PSO for tuning the parameters of membership functions of 
FLC is proposed. The proposed PSO-FLC is carried out for 
wastewater treatment process by minimizing input-output 
errors using two different error functions. Two controller have 
been implemented, one to control the dissolved oxygen 
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Abstract — Network intrusion detection system attempts to 
detect attacks at the time of occurring or after they took place. 
Since it is reliable and produces less alarm rate but it fails to 
detect unusual or new attacks. In this paper we propose a 
hybrid IDS by combining the anomaly based detection 
approaches like Packet Header Anomaly Detector (PHAD), 
Network Traffic Anomaly Detector (NETAD), Application 
Layer Anomaly Detection (ALAD) and Learning Rules for 
Anomaly Detection (LERAD). The hybrid IDS obtained is 
evaluated using the KDD Cup 99 traffic data and Tcpdump 
data (Real Time Data). The number of attacks detected by 
misuse based IDS is compared with the hybrid IDS obtained by 
combining anomaly and misuse based IDSs and shows that the 
hybrid IDS with ALAD and LERAD performs well by 
detecting 149 attacks out of 180 (83%) attacks after training on 
one week attack free traffic data. 

Keywords- Intrusion detection; Snort, Packet Header Anomaly 
Detection (PHAD); Network Traffic Anomaly Detector (NETAD) 
; Application Layer Anomaly Detector (ALAD); Learning Rules 
for Anomaly Detection (LERAD); KDD Cup99 dataset and Real 
time traffic data. 

I. Introduction 

Internet is one of the most powerful innovations in today's 
world. Though it brings all kinds of people together but some 
may use it to breech attacks. As internet and computers are 
connected with each other it helps the hackers to succeed in 
their tasks. So the computer security over network is inevitable 
to prevent against attacks through firewall, cryptography, 
filtering and avoiding unauthorized access but all these 
constraints are possible only by providing preventive 
measures. Normally the suspicious activities can be identified 
only through analyzing large volumes of data that are stored in 
network, host, log files, etc. An Intrusion Detection System 
was first coined by Anderson (1980) [1] in a technical report. 
IDSs are used to stop attacks or recover from it with some loss 
and to analyze the security issues so that it can be avoided in 
future [2]. Computer crime security survey has been listed that 
ids usage in 1999 is seems to be 42% but in 2003 it has been 
increased to 73%. This result shows that the IDS as the 
immense defense weapon toward security issues. An attack is 
a kind of software that is made to destroy the particular task or 
evolving congestion over the network. According to security 
research community the term attack in intrusion are 



interchangeable. Attack can be made via internet by the 
hackers capturing the accessing of normal user by sniffing the 
password. Intrusion detection system monitors the events 
occurred on individual host as well as over network to 
determine that the security has been violated. However the 
number of threats seems to be increasing continuously. So IDS 
has become an integral part of security measures within an 
organization [3, 4]. 

IDS are of two types host and network based IDS. In HIDS 
[5] the data come from audit record, system logs, application 
program etc, by comparing with network IDS to analyze 
network attack or an intrusion happened to particular hosts. 
Whereas the encrypted packets passes over the network from 
the system files and then decrypted in host machine. So the 
data are not affected and it does not require any special kind of 
hardware than monitoring system installed in specific host. In 
network based ids commonly one Intrusion Detection System 
is enough for the whole LAN. It is of low cost & capable of 
analyzing many attacks like DoS, DDoS, etc., but HIDS fails 
to analyze those attacks. 

Intrusion detection system has traditionally been classified 
into two classes namely anomaly detection and 
misuse/signature based detection. Misuse detection compares 
the upcoming network traffic to the database of known attack 
with the help of signatures to detect intrusions. It works 
efficiently in analyzing known attacks that are stored in the 
database. But it cannot detect new attacks that are not 
predefined. On the other hand, the anomaly detection approach 
creates a profile (normal) based on the network and hosts 
under inspection & raises alarms or some kind of notification 
to make the administrator to handle the situation. However 
they have being able to detect new & unusual attacks. There 
are two types of false alarms in determining the any deviations 
from normal pattern false positive and false negative. The 
main goal is to keep these alarms as low as possible. Data 
mining techniques such as association, classification, 
clustering and neural networks have been used in intrusion 
detection [6, 7]. Snort is the network based anomaly detection 
method. It captures the packets that are transmitted over the 
network by analyzing the real time traffic [8], It depends upon 
the signatures that are predefined and work in terms of content 
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analyses basis. It saves the packet in a database as a tcpdump 
files. From that the data would be analyzed and alerts are 
made accordingly. Since it is an open source tool and mainly 
used for signature based detection we have chosen snort for 
our work. On the other hand, the anomaly detection approach 
creates a profile (normal) based on the network and hosts 
under inspection & raises alarms or some kind of notification 
to make the administrator to handle the situation. 

In this paper the various anomaly detection approaches 
such as ALAD, NETAD, PHAD, and LERAD has been used 
to model the suspicious traffic over network rather than user 
behavior. Misuse based model considers only the user 
behavior to create the pattern but it may not be useful in all 
environments. In order to avoid this dependency, an anomaly 
based techniques has chosen for the study. 

This paper is organized as follows: Section 2 provides related 
work dealt with a data mining approach in intrusion detection. 
Section 3 includes the contribution of the work. Section 
4compares the misuse based and anomaly based approaches. 
Section 5 explains the architecture of the hybrid IDS towards 
computer security. Section 6 the data set used and its features 
in detail. Sections 6 describe the performance evaluation of 
various anomaly based approach. Section 7 includes 
experimental analysis & result. Section 8 refers to conclusion 
& future enhancement. 

II. RELATED WORK 

Anomaly Detection can be done from attack free data. 
Network anomaly detectors usually models low level 
attributes. Machine Learning and data mining techniques has 
proven to be beneficially applicable in intrusion detection field 
as they are potentially adaptable to any change according to 
new information acquired. Association rule is one among the 
widely used method to build IDS [9]. Casewell and Paxson 
[10, 11] used IDSs based on misuse model. Other attempts to 
solve intrusion detection and prevent attacks in future with 
reference to the information gleaned from the distributed IDS 
can be found in [12, 13]. Statistical based approaches assume 
that the network traffic accepts and act in favor of quasi 
stationary process. But this, situation is not applicable in 
realistic and leads to high false alarm rate. Due to the immense 
change in the behavior of global internet the attacker can 
easily exploit attack over network. So the intrusion detection 
must be done on the connection features at the network, 
transport layer and application layer [14, 15], 

Kai Hwang et al [16] collect the anomalous traffic 
analyzed from internet with the help of ADS. A weighted 
signature scheme is developed to correlate ADS with snort 
thereby detecting novel attacks fastly and improves the 
accuracy of detection process. The signature generated by 
ADS improves the performance of Snort by 33%. The server 
or operating system compromised in UNIX system is found 
through call sequence method. It has been modeled using n 
grams and neural networks can be found in [17, 18]. Zhenwei 



Yu et al [19] present an automatically tuning process (ATIDS) 
that will automatically tune the detection process according to 
the report provided by the system operator in case of false 
prediction is achieved. 

In [20] the real time & DARPA dataset has been used for 
the evaluation. The simulated dataset performs well while 
compared to mixed dataset. PHAD [21] detects 29 attacks out 
of 201 instances using non stationary model based on the time 
sequence than average frequency. NETAD system detects 132 
out of 185 attacks in DARPA evaluation dataset. It uses fast 
filter method to locate the hostile events. Incremental LERAD 
provides similar accuracy as that of offline by generating 
fewer rules and decreasing overhead in detection process can 
be seen in [22]. Mahoney [23] used four anomaly detection 
approaches to solve the detection problem by modeling 
network protocol from data link layer, application layer, 
packet header and extracting good rules from poor set of rules. 
Mahoney and Chan [24] have introduced a new concept that 
facilitates the automatic adaptation during traffic model 
generation against assumption. 

III. CONTRIBUTION 

• High level of human interaction is needed during 
modeling the intrusion detection system. To solve the 
work load in preprocessing the snort has been used to 
automatically analyze the traffic. 

• Based on this technique, a hybrid IDS 
(Snort+ALAD+LERAD) is developed according to the 
environment where it is deployed and validated through 
simulation experiments. 

• The new signatures are generated from anomalies 
detected by snort based approach. This new approach 
automatically simulates NIDS to detect similar 
anomalous attacks in future. 

• Hence this approach is useful in case of automatic 
detection of intrusion over network. It also detects better 
than other methods. 

IV. METHODOLOGY 

Here the misuse based and anomaly based approach has 
been taken for the study. Comparison is made based on its 
performance by analyzing the detection rate of snort of its own 
with the anomaly based algorithms. Here Snort requires 
frequent revision in order to capture new attacks from existing. 
Snort has predefined rules and also we can able to update any 
rules in future. Under anomaly based approach, we have four 
types of statistical methods like PHAD, NETAD, ALAD and 
LERAD respectively [25]. We can see it one by one, 

A. SNORT 

Snort is developed by Martin Roesch, a software engineer 
in 1990 attempts to detect attacks occurred in his computer. It 
is a fast; rule based and misuse detection methods written in a 
specific language. It is possible to integrate new functionalities 
within the snort during the time of compilation. It makes use 
of text files or tcpdump files to store the packets. Tcpdump is 
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a kind of tool or program that is used to capture the various 
hosts in a network [26, 27]. 

A simple Snort rule shown in Fig. 1 is "sensitive data". 
This states that, if an entry does not match with the specified 
constraints, a sensitive data message is stored within the snort 
otherwise an alert message is specified. The field can be TCP, 
UDP and ICMP. The protocol specified in our example is TCP 
followed by source and destination address. 



04/23-18:04:09.543108 [**] [138:5:1] SENSITIVE-DATA 
Email Addresses [**] [Classification: Sensitive Data was 
Transmitted Across the Network] [Priority: 2] {TCP} 
74.125.236.55:80 -> 192.168.1.17:4489 



Figure 1, Snort Rule Structure 

B. Packet Header Anomaly Detector (PHAD) 

Packet Header Anomaly Detector is the first one among the 
four anomaly based approach that can be added to the snort for 
automatic identification of network traffic. It not only models 
protocol but also the time at which the last anomaly found in 
testing phase from that of training phase by monitoring both 
input and output traffic. It reduces the number of alarms by 
indicating the alarm only for the first anomaly that took place. 
The anomaly score is calculated by using the formula, 



T= tn/r 



(1) 



Where, 

n= number of packets arrived from that the anomaly value 

must be searched. 

r = number of values considered as normal. 

t = time of the last anomaly occurred. 

PHAD can model 33 attributes of packet header fields with 
1 to 4 bytes. The fields that are lesser than 1 byte is taken as 1 
byte and more than 4 byte is rounded to 6 byte respectively. 

C. Network Traffic Anomaly Detector (NETAD) 

Network Traffic Anomaly Detector is the second kind of 
anomaly based approach. It works as that of PHAD the only 
difference is that, it posses two phases. First, to filter the 
incoming traffic sequence is filtered to differentiate the 
beginning of sequence. Second is the modeling phase. The 
filtering phase models the traffic from 98 to 99%. Then the 
remaining packet enters the modeling phase. The second phase 
models 5 types of packets [28] such as, 

• All IP packets 

• All TCP packets (if protocol TCP (6)) 

• TCP SYN (if TCP and flags =SYN (2)) 

• TCP data (if TCP and flags = ACK (16)) 

• TCP data for port number between and 255 (if TCP 
and ACK and DPI (high order bit of destination port) 
=0) 

Anomaly score is calculated using 



Where, n a is the number of normal packets from where the last 
anomaly found. 256 is the constant coefficient value. 

D. Application Layer Anomaly Detector (ALAD) 

Application Layer Anomaly Detector provides conditional 
rules. It can be modeled by the condition that, if the 
probability of an event has a set of values then the other set 
would has some particular value. This method provides good 
result in the experimental study. 
The general form is, 



P= Pr (X=x Z=z| A=a Z=Z) 



(3) 



AS= tn a (l-r/256)/r+tin(ni+r/W) 



(2) 



If the consequent is X=x, Z=z then the antecedent would be 
A=a, B=b. It uses four rules for modeling namely, 

• Pr(source IP address | destination IP address) 

• Pr(source IP address | destination IP address, 
destination port) 

• Pr (destination IP, destination port) 

• Pr(TCP flags (first, next to last packet) | destination 
port) 

E. Learning Rules for Anomaly Detector (LERAD) 

Learning rules for anomaly detector monitors the TCP 
connections as that of ALAD and the only difference is extract 
the good rules form the existing set of rules. Every rule is 
applied to testing phase at least once. While considering the 
time, while the matching attribute values increases then 
automatically the time interval seems to be increasing. It 
generates rules for randomly selected sample from the training 
set, discard the rule which does not favors the rule n/r. Include 
rules for the whole training set and perform validation test by 
excluding the rules that performs anomaly. 



V. DATA SET DESCRIPTION 

Both the combination of real time traffic from LAN 
network and KDD cup are chosen in this study. KDD cup 99 
dataset [29] has been used to analyze the network intrusion 
detection and it is developed by Stolfo et al based upon 
DARPA dataset from MIT Lincoln Laboratory as an 
evaluation benchmark. The dataset involves approximately 4 
million connection records with 41 related features & 21 
attack types. All different attacks fall into 4 major categories 
as dos, probe, u2r and r21 attacks labeled as attack and normal 
type. The attack free data from the kdd cup and LAN network 
are taken as training set and one week attack data from kdd 
cup as testing set. Attacks can be described as 

A. Dos Attack- It is a kind of attack where the attacker makes 
processing time of the resources and memory busy so as to 
avoid legitimate user from accessing those resources. 

B. U2R Attack - Here the attacker sniffs the password or 
makes some kind of attack to access the particular host in a 
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network as a legitimate user. They can even promote some 
vulnerability to gain the root access of the system. 

C. R2L Attack- Here the attacker sends a message to the host 
in a network over remote system and makes some 
vulnerability. 

D. Probe Attack - Attacker will scan the network to gather 
information and would make some violation in future. 

Table. 1 Name of the attacks classified under 4 groups 



Denial of 
Service 


Back, land, neptune, pod, smurf, 
teardrop 


Probes 


Satan, ipsweep, nmap, port sweep 


Remote to 
Local 


ftp_write, , imap, guess_passwd, phf, 
spy, warezclient, multihop, warezmaster 


User to Root 


buffer_overflow, load module, Perl, 
root kit 



VI. ARCHITECTURE OF THE HYBRID IDS 




Input- Network Packet:.- KDD 
Cup 99 Data set 



Snort (Signature -Based) Network 
Packets 




Ye r , 



Drop Packets 



Perform Algorithm 




Output 



Yes 



Create Xev.- Rule 



Figure 1. Block Diagram of Proposed Hybrid IDS 

In figure 1, snort is installed in the computer within the 
network. Once it is installed it automatically captures the 
network packets that are passed over the network. In this, we 
include KDD Cup 99 dataset together within the snort. Since 
the set of rules are predefined inside the snort. It performs the 
preprocessing steps as per rules. Snort gives the alert message 
according to the information stored in the database as tcpdump 
files. If any attack is found then the packet is dropped 
otherwise it can be taken as attack free data. Here we apply the 
anomaly based approach such as ALAD, PHAD, NETAD or 



LERAD to automate the IDS by capturing the attacks 
synchronizing with the network. If any suspicious 
traffic/attack is found, it analysis the exact cause of it and 
creates the signature and finally included within the rule set in 
snort. 

VII. EXPERIMENTAL RESULTS 

Hybrid IDS is developed to overcome the human interaction 
towards pre-processing. Most of the evaluation on intrusion 
detection is based on proprietary data and results are not 
reproducible. To solve this problem, KDD cup 99 has been 
used. Lack of public data availability is one of the major issues 
during evaluation of intrusion detection system. Totally out of 
500 instances, 320 instances involved in training phase and 
remaining 180 instances are taken for testing phase. Analysis 
is done based on the scenarios given below: 

A. Based on Snort 

B. Based on Snort + PHAD 

C. Based on Snort +PHAD+ALAD 

D. Based on Snort + ALAD+LERAD 

A. Performance of Snort 

Snort is tested on real time traffic and simulated dataset (one 
week data including attack) and attacks detected are listed day 
by day. The files have been downloaded from [30] and LAN 
network. Attack detected on daily order is shown in the below 
figure2. Snort has detected 77 attacks out of 180 attacks 
without adding any anomaly based approaches. 



■ snout 




Figure 2. Attacks detected by snort on a daily basis 

B. Performance of Snort+PHAD 

Attacks detected by Snort, LERAD and NETAD on their own 
and results in hybrid intrusion detection system (Snort + 
PHAD+NETAD) are shown in figure4. It is understood that 
after adding PHAD with Snort it detects better than before. 
The number of attacks detected by Snort increases from 77 to 
105 in Snort+PHAD version of IDS. 
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Figure 3. Attacks detected by Snort+PHAD on a daily basis 

C. Performance of Snort +PHAD+ALAD 
When PHAD and ALAD are added to the snort it detects more 
attacks than before. It is clearly shown from the graph Fig. 3 
that the number of attacks increases while adding PHAD and 
ALAD with Snort the IDS becomes powerful. The number of 
attacks detected by Snort+PHAD increase from 105 tol24 in 
Snort+ PHAD+ALAD. The main reason is Snort detects the 
attacks based on rule definition files but PHAD and ALAD 
detects using packet header and network protocol. 
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Figure 4. Attacks detected by Snort+PHAD+ALAD on a daily basis 

D. Proposed Hybrid IDS (Snort+ALAD+LERAD) 
Attacks detected by Snort, ALAD + LERAD on their own and 
results in the hybrid intrusion detection system (Snort + 
ALAD + LERAD) are shown in fig 5. After adding 
Snort+ALAD+LERAD, the ids give better results when 
compare with other methods. The number of attacks detected 
by Snort+PHAD+ALAD increase from 124 to 149 in Snort+ 
ALAD + LERAD (hybrid ids) version of the IDS. 




Figure 5. Attacks detected by Snort+ALAD+LERAD on a daily basis 
Table 2. Attacks detected by Snort, PHAD, ALAD, and LERAD 



Anomaly based approach 


Detection Rate 


Snort 


77/180(43% ) 


Snort+PHAD 


105/180(58%) 


Snort+PHAD+ALAD 


124/180(68% ) 


Proposed Hybrid IDS 
(Snort+ALAD+LERAD) 


149/180(83% ) 



VIII. CONCLUSION & FUTURE SCOPE 

For the past twenty years, several researches have been made 
in intrusion detection field. The overall aim is to develop a 
hybrid automatic intrusion detection system and thereby 
reducing the workload of the security experts. One of the 
major issues regarding human intervention in preprocessing is 
solved by implementing Snort with anomaly based approaches 
like Snort, PHAD ALAD, and LERAD. In this, Snort detects 
43% of attacks, Snort+PHAD detects 58% of attacks, 
Snort+PHAD+ALAD detects 68% of attacks and our proposed 
hybrid IDS (Snort+ALAD+LERAD) detects 83% of attacks as 
seen from above figures. 

In future, another hybrid detection model can be developed to 
detect the compromised system in the network which makes 
detection process fast and reliable. 
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